Kibana suggestion api not showing all values

I've recently upgraded to ELK stack (Kibana) 7.9.2 from 7.8.0. I am facing a weird issue which was not in the older version. The filter doesn't populate all the values of a field in discover or dashboards.

Let say a field (datatype keyword) has value1, value2, value3, value4, value5 and value6 when I select this field as a filter in discover or any dashboard. I only get four suggested values out of 6. I checked the values in index and it's all there but the Kibana suggestion API returning fewer values.

/api/kibana/suggestions/values/filebeat-*

NOTE: This is only happening in the case of filebeat. I've checked this in metricbeat and heartbeat indexes and it's working there.

Please suggest if there is a workaround or configuration to make it right. Any help would be highly appreciated.

Is it showing a little warning triangle next to the label of the filter? If that's the case you can try increasing kibana.autocompleteTimeout and kibana.autocompleteTerminateAfter in your kibana.yml file (https://www.elastic.co/guide/en/kibana/current/settings.html)

To respond fast the suggestion API is not waiting for Elasticsearch to query your complete data set - depending on the exact scenario this can cause entries to be missing.

1 Like

Thanks for your reply @flash1293. It doesn’t show me any warning or error message. I checked the logs as well and couldn’t found anything that is breaking.

Are you talking about the filter bar or the input control visualization? For the filter bar no warning would be shown - try increasing the settings in that case.

@flash1293 I am referring to the filter bar that appears on the top left corner of discover tab. Please find the attached screenshot for more clarity.

filter_err

OK, you won't get a warning icon there. Let me know whether bumping up those settings helps.