Query DSL causes SearchPhaseExecutionException

Elastic Stack Kibana
1

Hey!

I'm trying to visualize data for multiple documents. Since I'm not being able to import a file with the ids of the documents in Kibana, I'm building a Query DSL using a Python script.

The query works just fine in Discover (tested with 100 documents so far in a filter), but when I'm trying to do the same in a Dashboard everything crashes. It's important to see the results in visualisations.

I'm using ELK 7.10.
Here is a detailed exception from ElasticSearch:

[2020-11-20T13:30:08,323][WARN ][r.suppressed             ] [test-node-1] path: /.kibana_task_manager/_count, params: {index=.kibana_task_manager}
org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed
        at org.elasticsearch.action.search.AbstractSearchAsyncAction.onPhaseFailure(AbstractSearchAsyncAction.java:568) [elasticsearch-7.10.0.jar:7.10.0]
        at org.elasticsearch.action.search.AbstractSearchAsyncAction.executeNextPhase(AbstractSearchAsyncAction.java:324) [elasticsearch-7.10.0.jar:7.10.0]
        at org.elasticsearch.action.search.AbstractSearchAsyncAction.onPhaseDone(AbstractSearchAsyncAction.java:603) [elasticsearch-7.10.0.jar:7.10.0]
        at org.elasticsearch.action.search.AbstractSearchAsyncAction.onShardFailure(AbstractSearchAsyncAction.java:400) [elasticsearch-7.10.0.jar:7.10.0]
        at org.elasticsearch.action.search.AbstractSearchAsyncAction.lambda$performPhaseOnShard$0(AbstractSearchAsyncAction.java:236) [elasticsearch-7.10.0.jar:7.10.0]
        at org.elasticsearch.action.search.AbstractSearchAsyncAction$2.doRun(AbstractSearchAsyncAction.java:303) [elasticsearch-7.10.0.jar:7.10.0]
        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:737) [elasticsearch-7.10.0.jar:7.10.0]
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-7.10.0.jar:7.10.0]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) [?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) [?:?]
        at java.lang.Thread.run(Thread.java:832) [?:?]

For testing this I'm using the eCommerce example data ([eCommerce] Revenue Dashboard).

Added settings in Kibana:
kibana.autocompleteTerminateAfter: 1200000
kibana.autocompleteTimeout: 100000
This is because I've tried to force Kibana to load all the data available in the DashBoard.

2

Hi can you please provide the query DSL used with the eCommerce data sample so I can test it locally with the same environment?
Thanks

3 
{
  "query": {
    "bool": {
      "should": [
        {
          "match_phrase": {
            "_id": "kY2a-3UBLLJEZe3oCWnK"
          }
        },
        {
          "match_phrase": {
            "_id": "ko2a-3UBLLJEZe3oCWnK"
          }
        },
        {
          "match_phrase": {
            "_id": "k42a-3UBLLJEZe3oCWnK"
          }
        },
        {
          "match_phrase": {
            "_id": "lI2a-3UBLLJEZe3oCWnK"
          }
        },
        {
          "match_phrase": {
            "_id": "lY2a-3UBLLJEZe3oCWnK"
          }
        },
        {
          "match_phrase": {
            "_id": "lo2a-3UBLLJEZe3oCWnK"
          }
        }
      ],
      "minimum_should_match": 1
    }
  }
}

This is just a sample. I have reduced the amount of _ids so it can be viewed.
Also please note that the ids I have here are from Web Traffic example, tested on the Web Traffic data. I have removed the old environment which was running in Windows and tried again in Debian using Web Traffic this time.

4

Thanks for the example.
I'm trying to reproduce it but seems to work fine on my end. I'm trying with a ~200 _ids and seems to work fine both on Discover and Dashboard.
Could you please post any error that appear on the Dashboard and on the Chrome dev tool console if possible?
It will be also great to have a look at the network calls on that failing dashboard (an HAR file will be awesome https://toolbox.googleapps.com/apps/har_analyzer/)

5

Ok, so here's what I did now:
Extracted 199 ids and searched for them in Discover. Everything has been found.
Went to Dashboard and clicked on +Add filter -> Edit as Query DSL -> Save (same query used as in Discover).

The Dashboard shows 0 data and some visualisations like File Type Scatter Plot show messages like:

Infinite extent for field "time": [Infinity, -Infinity]
Infinite extent for field "_source.bytes": [Infinity, -Infinity]

Here is the HAR: https://gofile.io/d/2s5XON

Thank you!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.