Kibana -> Stack Management -> Index Patterns -> filebeat-* does not load

Elastic Stack Kibana
#1

I have a weird one.

When I try to load the settings page for the filebeat-* index pattern, no settings appear.

All I see is the Kibana lefthand menu and header.

If I load the metricbeat-* index pattern settings, I see the normal options.

I tried manually deleting the filebeat index pattern, then rerunning filebeat setup. It didn't help.

I am running Kibana 7.9.0 via docker, behind an Apache reverse proxy. With Firefox devtools open to the network tab, the only error code I see is a 413 for a PUT.

Copying from Firefox devtool gave me:

{"PUT":{"scheme":"https","host":"myhost","filename":"/api/saved_objects/index-pattern/filebeat-*","remote":{"Address":"myip:443"}}}

I watched the Kibana container logs while I navigated to the filebeat index pattern after restarting it, so I have those if needed.

My ES cluster is 3 nodes running 7.9.0. Installed via the official apt repos on Ubuntu 18.04.

One note, I have been noticing that loading dashboards from metricbeat is extremely slow. There is some mention of the filebeat index pattern in the devtools network tab. So I thought I should resovle the filebeat index pattern settings page issue before trying to diagnose why my dashboards are so slow...

Any ideas?

Thanks in advance.

#2

Did you migrate to 7.9.0 or is this a fresh install? I ask because there is one mention of 413 payload too large in a ticket, but it might be unrelated.

Anything at all in your Kibana logs when you hit that page?

#3

Yes, this is an upgraded cluster. I believe I started it around 7.0. (Note: I've had lots of issues with it... See some of my other topics... Like just now I see it's in the red due to a CorruptIndexException.)

The kibana logs appear to all have status codes of 200. Except for this one:

testelk01_kibana | {
  "type": "response",
  "@timestamp": "2020-09-03T10:10:21-07:00",
  "tags": [],
  "pid": 6,
  "method": "put",
  "statusCode": 413,
  "req": {
    "url": "/api/saved_objects/index-pattern/filebeat-*",
    "method": "put",
    "headers": {
      "host": "127.0.0.1:5601",
      "user-agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101 Firefox/80.0",
      "accept": "*/*",
      "accept-language": "en-US,en;q=0.5",
      "accept-encoding": "gzip, deflate, br",
      "referer": "https://mykibana.domain.tld/app/management/kibana/indexPatterns/patterns/filebeat-*",
      "content-type": "application/json",
      "kbn-version": "7.9.0",
      "origin": "https://mykibana.domain.tld",
      "dnt": "1",
      "pragma": "no-cache",
      "cache-control": "no-cache",
      "x-forwarded-for": "mylaptopip",
      "x-forwarded-host": "mykibana.domain.tld",
      "x-forwarded-server": "mykibana.domain.tld",
      "connection": "Keep-Alive",
      "content-length": "2167293"
    },
    "remoteAddress": "172.27.0.1",
    "userAgent": "172.27.0.1",
    "referer": "https://mykibana.domain.tld/app/management/kibana/indexPatterns/patterns/filebeat-*"
  },
  "res": {
    "statusCode": 413,
    "responseTime": 3104,
    "contentLength": 9
  },
  "message": "PUT /api/saved_objects/index-pattern/filebeat-* 413 3104ms - 9.0B"
}