Kibana error while querying in Discover

@stephenb will try that now, thanks so much for your help.

Hey, @stephenb re-creating the index pattern did not solve the issue.

Not sure what to tell you ... Is it the exact same error?

Perhaps that index is corrupted...

In Kibana -> Dev Tools run

GET _cat/indices?v

And look for that index and share the results...

Hey @stephenb all of them seems to be open and green:

health status index            uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   windows-20221108 aOIc5is-TAugeZ1cT9xYJg   3   0  220880812            0    171.6gb        171.6gb
green  open   windows-20221109 8p_5GD2LRwqS7f_fxjTnJw   3   0  245020349            0      189gb          189gb
green  open   windows-20221120 9iq6w7-4R0Wumz-vWgDcFg   3   0  236433967            0    171.4gb        171.4gb
green  open   windows-20221121 8waqtV2SRfCvTMIxsnKZog   3   0  204258314            0    158.4gb        158.4gb
green  open   windows-20221124 5aGXy2qrQCS1IUzd2YXv2w   3   0  172402139            0    122.5gb        122.5gb
green  open   windows-20221201 DcGK5_c7S-2KD_C1aDtfGQ   3   0  209930161            0    160.3gb        160.3gb
green  open   windows-20221125 XKIdD44bREuFpYgRrrKGPw   3   0  172447488            0    122.3gb        122.3gb
green  open   windows-20221202 rFrzJEu9Q1aDEp4WgdeFOA   3   0  147624820            0    111.4gb        111.4gb
green  open   windows-20221103 R0bUB4L3T8-RhlP5ItO-gw   3   0  240127289            0    190.6gb        190.6gb
green  open   windows-20221122 EUobZlnTTae1HhpZtylI0w   3   0  191046693            0    144.5gb        144.5gb
green  open   windows-20221123 F-DGXeZTRliWaRwgQbPr7g   3   0  257294746            0    186.7gb        186.7gb
green  open   windows-20221106 R-Qoyld4SOiXkLlWBryrJw   3   0  216156710            0    156.7gb        156.7gb
green  open   windows-20221128 m18C_GGDS3izQL7uHrX5iw   3   0  211388710            0    174.7gb        174.7gb
green  open   windows-20221129 AHvyto09StOI1H9RA_SnkQ   3   0  200924697            0    151.7gb        151.7gb
green  open   windows-20221107 wQ1Ik4HyQSmlYHRCrp8Npg   3   0  218092105            0    169.2gb        169.2gb
green  open   windows-20221126 GohKPNPIQXyqyALtQRcUcw   3   0  235915860            0    164.7gb        164.7gb
green  open   windows-20221104 M4JYzV6FTJymdjIo52WFLQ   3   0  203452202            0    156.8gb        156.8gb
green  open   windows-20221127 l7UE_PVtQTOWDi-EITaS6A   3   0  172934836            0    121.9gb        121.9gb
green  open   windows-20221105 P140Mg2ZQ2-QgOXP1r2u3w   3   0  211773400            0    152.5gb        152.5gb
green  open   windows-20221119 la9LcUk-SUO65prM_dc8pQ   3   0  208053428            0    148.2gb        148.2gb
green  open   windows-20221110 nZVLFSouToO1i-iLBvHyBA   3   0  250872872            0    189.7gb        189.7gb
green  open   windows-20221130 jV_FOAZhT9SeSwLUUfFskw   3   0  267761867            0    197.4gb        197.4gb
green  open   windows-20221113 l1l6EjnQRaqJELQ3qH-CyA   3   0  153571460            0    112.9gb        112.9gb
green  open   windows-20221114 a_orPURHQDmXdk5oTaRdKA   3   0  191042162            0    144.5gb        144.5gb
green  open   windows-20221111 nTcAfLDDQT6Ex0DSHN2VXg   3   0  189393778            0    142.3gb        142.3gb
green  open   windows-20221112 v1RroalUTAKT3kEBPArPSQ   3   0  250022184            0    176.9gb        176.9gb
green  open   windows-20221117 F1Vxxs5aTouVtKGWepVyBg   3   0  283041508            0    208.5gb        208.5gb
green  open   windows-20221118 ttZZJ42QQjeO7B-veBVVog   3   0  187955210            0    140.8gb        140.8gb
green  open   windows-20221115 oRhchDPsQDeNC05TKuzQmQ   3   0  197197254            0    149.6gb        149.6gb
green  open   windows-20221116 Ru6PgyvBRMKqwuSMUxcR8A   3   0  282573229            0    207.2gb        207.2gb

Not sure what to tell you at this point...
Completely Clear your Browser Cache.
Look in the Browser Dev Tools see if you can figure anything else out.
Upgrade to a Newer Version of the Stack,
Reinstall Kibana same version...
Did you try other browsers? Did you try Chrome / FireFox?

Exactly what "Search" are you doing in Kibana... Is the filter bar empty or did you put something in to search?

Screen Shot?

Hey, @stephenb one pattern I'm noticing here is that. The nodes where the discover tab is working can reach kibana/internal/search/ese but not the one that is not working. Have you seen that before?

Sorry I don't know what you mean by "The nodes where the discover tab is working" do you have different servers you are running Kibana on?

@stephenb I've other nodes with kibana installed and with a windows pattern that has the same characteristics that are able to reach kibana/internal/search/ese with no problems. When I open the firefox development tool I can see that the node that is having the issue with the bad request cannot reach to that but the others do.

So if you are saying only 1 node / server of N is having an issue... I would focus on that node...

Sounds like some sort of connectivity issue or corrupted .js or permission... is there a proxy in the middle ...

You have a 1 of N issue ... you need to find out what is different / broken with that 1...

Apologies @Michael_Sanchez I have no magic answers for you.

@stephenb no worries. Thanks for everything. Quick question if I re-install Kibana will I lose my dashboards, etc?

The dashboards are stored in an index in elasticsearch so not you should not loose them but I would export them as saved objects (in fact I would export ALL saved objects just as a backup that would be the prudent approach)

@stephenb but i would need to re-create all the index patterns right?

No Index Patterns are also stored in Elasticsearch.
Index Pattern are saved Objects, so also export them and you can restore well.
Export ALL the saved object for saftey.

Perhaps you should set up a simple Test
Install a simple Single Node Elasticsearch CLuster and Kibana ...
And create some dashboards / index patterns....
Export them for safety.
Delete Kibana and Re-Install Kibana and see if the object are still there... (they should be)
If not you have the export.

I would certainly do all that to test if that was My production / Important System

1 Like

@stephenb have you seen this before:

400 Bad request
Request must contain a kbn-xsrf header

Please look carefully at the docs including the proper version.
The API is / was brand new in 7.10.

You Can Export Saved Objects from Stack Management - Save Objects as well.

I would do that as well.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.