Kibana crashing when storing complex items on Elasticsearch

Elastic Stack Kibana
1

Hello,

This is my first post in the community. I've been following this forum over the last months as I started to use more and more Elasticsearch on my day to day. I've been using Elasticsearch to store data from several tools or services, and it has been working really well.

Most of the schemas of my own indexes are quite simple, and there are other external services that return me really big/complex objects, which I've been storing in Elastic without any problem at all.

Since I've never had any problems with this, I never spent too much time around mappings, etc.

However, the last script I developed (a website monitor) returns a bigger object, and I would like to storeit on Elastic.

Since this structure is a little bit more complicated that all the others, this time I've had to manually define certain object types in the mapping, since Elastic ended up defining different types that I actually wanted.

The first days I used this index I had no problem at all, however, at this moment if I try to query the last 15 days, Kibana hangs and the Chrome Tab ends up crashing. Bear in mid that I only have like 15 total objects on the index, so i rule out any thing related with the volume of data.

Therefore, the only thing that occurs to me is that perhaps i'm not following a specific Elastic best practice or something similar that is causing Elastic/Kibana to not being able to deliver me the information I want...

  1. Is there a problem using multiple arrays of jsons inside of the object?
  2. Is there any chance, an _ignored field be the root cause of all of this?

Hopefully this all makes sense.

Kind regards,
Rob

2

Welcome to our community! :smiley:

What do you mean by crash exactly.
What do your Kibana instance logs show at this time?

3

Hi @warkolm,

Thanks for your reply.

Chrome returns me the Error "RESULT_CODE_HUNG" on the crashed Tab.

The only logfile I checked was:

/var/log/kibana/kibana.log

I made a "tail -f" during the query and I only obtained two lines, which I believe don't say anything special:

{"type":"response","@timestamp":"2022-05-31T02:11:43+01:00","tags":[],"pid":1134,"method":"post","statusCode":200,"req":{"url":"/internal/bsearch?compress=true","method":"post","headers":{"host":"kibana.domain.local:5601","connection":"keep-alive","content-length":"3576","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"102\", \"Google Chrome\";v=\"102\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36","kbn-version":"7.17.2","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://kibana.domain.local:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://kibana.domain.local:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7"},"remoteAddress":"10.200.1.8","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36","referer":"https://kibana.domain.local:5601/app/discover"},"res":{"statusCode":200,"responseTime":157},"message":"POST /internal/bsearch?compress=true 200 157ms"}
{"type":"response","@timestamp":"2022-05-31T02:11:44+01:00","tags":[],"pid":1134,"method":"post","statusCode":200,"req":{"url":"/internal/bsearch?compress=true","method":"post","headers":{"host":"kibana.domain.local:5601","connection":"keep-alive","content-length":"2904","sec-ch-ua":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"102\", \"Google Chrome\";v=\"102\"","content-type":"application/json","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36","kbn-version":"7.17.2","sec-ch-ua-platform":"\"Windows\"","accept":"*/*","origin":"https://kibana.domain.local:5601","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"https://kibana.domain.local:5601/app/discover","accept-encoding":"gzip, deflate, br","accept-language":"pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7"},"remoteAddress":"10.200.1.8","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36","referer":"https://kibana.domain.local:5601/app/discover"},"res":{"statusCode":200,"responseTime":7590},"message":"POST /internal/bsearch?compress=true 200 7590ms"}

Did you mean this logfile?

Kind regards,
Rob

4

Ok, so there's nothing in there that shows Kibana has crashed so it seems related to your browser.

Can you share what was in dev tools?

5

Thanks again for reaching back.

I'm not sure what you mean by what was in dev tools. I was making the query using the Analytics Discover tool, not via Dev Tools.

Also, the query in Discover was pretty simple (just all results from 14d ago):

image
image1575×818 24.6 KB

As you can see I only have 12 objects and in the bottom you see Kibana hanging well enough to allow me to take a screenshot while it says it is loading the results. Nevertheless, the results are not loaded and the tab ends up crashing in the aforementioned manner.

Kind regards,
Rob

6

Sorry I mean in the browsers devs tools, not the Kibana one.

7

Oh... It says the connection to the Debugger has been terminated and the reason it gives me is "Render process gone":

image

This happened following several requests to /internal/bsearch?compress=true, one of them was hanging for a lot of time (until chrome crashed).

Kind regards,
Rob

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.