Kibana error while querying in Discover

Elastic Stack Kibana
1

Hello team,

I'm seeing the following error while making a search in "Discover":

search_phase_execution_exception


Error: Bad Request
    at Fetch._callee3$ (kibana/36063/bundles/core/core.entry.js:6:59535)
    at l (kibana/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740520)
    at Generator._invoke (kibana/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740273)
    at forEach.e.<computed> [as next] (kibana/36063/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380:1740877)
    at fetch_asyncGeneratorStep (kibana/36063/bundles/core/core.entry.js:6:52652)
    at _next (kibana/36063/bundles/core/core.entry.js:6:52968)
2

Can someone please help with this? Thanks in advance.

3

Someone?

4

Hi @Michael_Sanchez

You're going to have to provide more details.

What version of Kibana and Elasticsearch?

How did you install?

What OS?

What Browser?

Is Kibana working at all or is it just Discover?

Are you issuing a query Discover ? or just discover loading. Tell us as much as you can and perhaps someone can help.

5

Hello @stephenb Thanks so much for your response:

{
  "name" : "log-1",
  "cluster_name" : "itagroup",
  "cluster_uuid" : "RFFFmESlR5CVdJmr4slRtw",
  "version" : {
    "number" : "7.10.1",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "1c34507e66d7db1211f66f3513706fdf548736aa",
    "build_date" : "2020-12-05T01:00:33.671820Z",
    "build_snapshot" : false,
    "lucene_version" : "8.7.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

Kibana version is the same and a deb package as well.

OS: Debian 10 buster
Browser: Firefox/Chrome

Kibana is working well is just the Discover tab with one specific index. All other indices are fine. And I'm issuing a query discover.

6

Perhaps need to re-create the index pattern.
Can you share details on the index / index pattern
Also 7.10 is VERY old perhaps upgrade.

7

Hey @stephenb can you please instruct me on how to do that?.

8

Kibana - Stack Management - index Pattern

You can delete and create an index pattern.

9

Thanks @stephenb I have a question, is there any reason why this happens? Also, what will happing with the data in that index if I delete it and create it again? Thanks in advance.

10

@Michael_Sanchez

I do not know why it is happening.

Not enough information, very old Version

Maybe the Kibana install is corrupt... Clear the Browser Cache...

Perhaps re-install ... is Kibana and Elasticseach on the Same version?

to Be Clear ... I said delete and re-create the index pattern NOT the actual index.

The index Pattern is what Allows Discover to view a set of indices... Think of it as an Alias.

The index contains the actual data do not delete that.

Do not delete the actual index.

11

@stephenb gotcha, thanks so much.

12

Hey @stephenb will the new pattern have all the index types?.

13

I'm sorry I mean all its fields.

14

Did you simply try to open Kibana in an incognito window did you get the same behavior?

the Index Pattern should re-create all the fields but if you did any customizations to the index pattern they would be lost.

You could export it first I believe 7.10 is so old I can't remember

15

Will try that, thanks.

16

Hello @stephenb is it possible to export the index pattern that is having the issue and then delete it and create it again and import the exported index-pattern so it will have all the previous data?. Kind of like a backup?. Thanks in advance.

17

Yes in current Versions...

In 7.10 I am not sure... you can go to

Kibana -> Stack Management -> Saved Objects -> Export

And look to export the Index Pattern

And see if you can do that...

IF you have not add / edited it etc... then when you re-create it is will add all the fields automatically etc... with all the defaults.

18

@stephenb I can see that option in 7.10 but I'm not seeing how to create the new index pattern from the exported file. Or should I first create the new index pattern and then import the exported pattern?. I think I just answer that question my self LOL. But thanks in advance for any other tips.

19

@stephenb also should i delete the saved object or the index-pattern itself?.

20

Export The Index Pattern as a saved object.

Then Stack Management -> Index Patterns -> Look at the Current Pattern make sure you know the pattern like myindex-* and what the timestamp field is..

Then Stack Management -> Index Patterns -> Delete the Index Pattern
Then Stack Management -> Index Patterns -> Create a New Index Pattern with the same configuration you saw... It will create all the fields for you

THEN really important to a Force Reload of Kibana (Shift Re-Load) then go check Discover