Kibana -> Stack Management -> Index Patterns -> filebeat-* does not load

I have a weird one.

When I try to load the settings page for the filebeat-* index pattern, no settings appear.

All I see is the Kibana lefthand menu and header.

If I load the metricbeat-* index pattern settings, I see the normal options.

I tried manually deleting the filebeat index pattern, then rerunning filebeat setup. It didn't help.

I am running Kibana 7.9.0 via docker, behind an Apache reverse proxy. With Firefox devtools open to the network tab, the only error code I see is a 413 for a PUT.

Copying from Firefox devtool gave me:

{"PUT":{"scheme":"https","host":"myhost","filename":"/api/saved_objects/index-pattern/filebeat-*","remote":{"Address":"myip:443"}}}

I watched the Kibana container logs while I navigated to the filebeat index pattern after restarting it, so I have those if needed.

My ES cluster is 3 nodes running 7.9.0. Installed via the official apt repos on Ubuntu 18.04.

One note, I have been noticing that loading dashboards from metricbeat is extremely slow. There is some mention of the filebeat index pattern in the devtools network tab. So I thought I should resovle the filebeat index pattern settings page issue before trying to diagnose why my dashboards are so slow...

Any ideas?

Thanks in advance.

Did you migrate to 7.9.0 or is this a fresh install? I ask because there is one mention of 413 payload too large in a ticket, but it might be unrelated.

Anything at all in your Kibana logs when you hit that page?

Yes, this is an upgraded cluster. I believe I started it around 7.0. (Note: I've had lots of issues with it... See some of my other topics... Like just now I see it's in the red due to a CorruptIndexException.)

The kibana logs appear to all have status codes of 200. Except for this one:

testelk01_kibana | {
  "type": "response",
  "@timestamp": "2020-09-03T10:10:21-07:00",
  "tags": [],
  "pid": 6,
  "method": "put",
  "statusCode": 413,
  "req": {
    "url": "/api/saved_objects/index-pattern/filebeat-*",
    "method": "put",
    "headers": {
      "host": "127.0.0.1:5601",
      "user-agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101 Firefox/80.0",
      "accept": "*/*",
      "accept-language": "en-US,en;q=0.5",
      "accept-encoding": "gzip, deflate, br",
      "referer": "https://mykibana.domain.tld/app/management/kibana/indexPatterns/patterns/filebeat-*",
      "content-type": "application/json",
      "kbn-version": "7.9.0",
      "origin": "https://mykibana.domain.tld",
      "dnt": "1",
      "pragma": "no-cache",
      "cache-control": "no-cache",
      "x-forwarded-for": "mylaptopip",
      "x-forwarded-host": "mykibana.domain.tld",
      "x-forwarded-server": "mykibana.domain.tld",
      "connection": "Keep-Alive",
      "content-length": "2167293"
    },
    "remoteAddress": "172.27.0.1",
    "userAgent": "172.27.0.1",
    "referer": "https://mykibana.domain.tld/app/management/kibana/indexPatterns/patterns/filebeat-*"
  },
  "res": {
    "statusCode": 413,
    "responseTime": 3104,
    "contentLength": 9
  },
  "message": "PUT /api/saved_objects/index-pattern/filebeat-* 413 3104ms - 9.0B"
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.