Kibana suggestion api not showing all values

Elastic Stack Kibana
1

I've recently upgraded to ELK stack (Kibana) 7.9.2 from 7.8.0. I am facing a weird issue which was not in the older version. The filter doesn't populate all the values of a field in discover or dashboards.

Let say a field (datatype keyword) has value1, value2, value3, value4, value5 and value6 when I select this field as a filter in discover or any dashboard. I only get four suggested values out of 6. I checked the values in index and it's all there but the Kibana suggestion API returning fewer values.

/api/kibana/suggestions/values/filebeat-*

NOTE: This is only happening in the case of filebeat. I've checked this in metricbeat and heartbeat indexes and it's working there.

Please suggest if there is a workaround or configuration to make it right. Any help would be highly appreciated.

2

Is it showing a little warning triangle next to the label of the filter? If that's the case you can try increasing kibana.autocompleteTimeout and kibana.autocompleteTerminateAfter in your kibana.yml file (https://www.elastic.co/guide/en/kibana/current/settings.html)

To respond fast the suggestion API is not waiting for Elasticsearch to query your complete data set - depending on the exact scenario this can cause entries to be missing.

1 Like
3

Thanks for your reply @flash1293. It doesn’t show me any warning or error message. I checked the logs as well and couldn’t found anything that is breaking.

4

Are you talking about the filter bar or the input control visualization? For the filter bar no warning would be shown - try increasing the settings in that case.

5

@flash1293 I am referring to the filter bar that appears on the top left corner of discover tab. Please find the attached screenshot for more clarity.

filter_err

6

OK, you won't get a warning icon there. Let me know whether bumping up those settings helps.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.