Kibana index is unresponsive

I created an index in Kibana using wildcard which is unresponsive, which means I cannot select it, it won't show any fields in the management tab, it just keeps loading in the discover tab. However, it works fine when I create the index using the exact name of the index. Is there a limit on the number of records an index can load because the index I am trying to create has more than 400 million records.


How many indices the index pattern encapsulates, and how many unique fields are within those.

Can you try this: http://localhost:9200/_field_caps?index=logstash-*&fields=*&ignore_unavailable&allow_no_indices
Replacing logstash-* with your index pattern.

I think yours is a very expensive operation from what I understand.

Am also tagging @Bill_McConaghy for more insights into this .


I ran the query you mentioned and I got the response.

"error": {
"root_cause": [
"type": "illegal_argument_exception",
"reason": "No endpoint or operation is available at [_field_caps]"
"type": "illegal_argument_exception",
"reason": "No endpoint or operation is available at [_field_caps]"
"status": 400

I tried the link with more than one index. Everything has the same response.

When you use the wildcard, does it match multiple indices? The gathering of field metadata can be expensive, especially if one of the indices lives on a slow node.

Also, what version of the Elastic stack are you running?

Correct me if I am wrong, by multiple indices do you mean if logstash-* also includes another index logstash-new-*. If this is the case then no it does not include multiple indices.

Elastic Search Version: 5.2.2

Yup that was my question. So there is only 1 index that matches logstash-*. Not sure why the two would behave differently. @chrisronline any ideas?

We changed how we retrieve data about indices on the management tag in 5.5.x. This change might help your use case. Are you able to upgrade and test it out?

I am using an enterprise version of elastic search. I am not sure if it can be upgraded.

What is the response if you issue this query in the Dev Tools:

GET _field_caps?index=<insert_name_of_index>&fields=*

Remember to change <insert_name_of_index> to the actual name of your index

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.