Kibana index is unresponsive

Elastic Stack Kibana
1

I created an index in Kibana using wildcard which is unresponsive, which means I cannot select it, it won't show any fields in the management tab, it just keeps loading in the discover tab. However, it works fine when I create the index using the exact name of the index. Is there a limit on the number of records an index can load because the index I am trying to create has more than 400 million records.

2

Hi,

How many indices the index pattern encapsulates, and how many unique fields are within those.

Can you try this: http://localhost:9200/_field_caps?index=logstash-*&fields=*&ignore_unavailable&allow_no_indices
Replacing logstash-* with your index pattern.

I think yours is a very expensive operation from what I understand.

Am also tagging @Bill_McConaghy for more insights into this .

Thanks
Rashmi

3

I ran the query you mentioned and I got the response.

{
"error": {
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "No endpoint or operation is available at [_field_caps]"
}
],
"type": "illegal_argument_exception",
"reason": "No endpoint or operation is available at [_field_caps]"
},
"status": 400
}

I tried the link with more than one index. Everything has the same response.

4

When you use the wildcard, does it match multiple indices? The gathering of field metadata can be expensive, especially if one of the indices lives on a slow node.

5

Also, what version of the Elastic stack are you running?

6

Correct me if I am wrong, by multiple indices do you mean if logstash-* also includes another index logstash-new-*. If this is the case then no it does not include multiple indices.

Elastic Search Version: 5.2.2

7

Yup that was my question. So there is only 1 index that matches logstash-*. Not sure why the two would behave differently. @chrisronline any ideas?

8

We changed how we retrieve data about indices on the management tag in 5.5.x. This change might help your use case. Are you able to upgrade and test it out?

9

I am using an enterprise version of elastic search. I am not sure if it can be upgraded.

10

What is the response if you issue this query in the Dev Tools:

GET _field_caps?index=<insert_name_of_index>&fields=*

Remember to change <insert_name_of_index> to the actual name of your index

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.