Reporting Fails

banderson · April 25, 2017, 7:46pm

When running a report manually, the result includes this error:

"last_execution" : {
  "timestamp" : "2017-04-25T14:30:58.978Z",
  "successful" : false,
  "reason" : "Watch[cisco_ios_severity_1] reporting[Cisco_IOS_Severity_1.pdf] Error when polling pdf from host[10.241.52.8], port[5601], method[POST], path[/api/reporting/generate/visualization/c29df220-1fa7-11e7-8b6d-7b620aec2238], status[200]"

What does polling pdf from host mean and where can I look for the cause?

banderson · April 25, 2017, 9:44pm

In the Kibana logs, right after the call to the reporting URL POST /api/reporting/generate/dashboard, I see this:

{
	"type": "response",
	"@timestamp": "2017-04-18T21:24:59Z",
	"tags": [],
	"pid": 30447,
	"method": "get",
	"statusCode": 503,
	"req": {
		"url": "/api/reporting/jobs/download/j1o25dhl0nhrf5f2c87jku08",
		"method": "get",
		"headers": {
			"kbn-xsrf": "reporting",
			"accept-charset": "UTF-8",
			"cache-control": "no-cache",
			"pragma": "no-cache",
			"user-agent": "Java/1.8.0_25",
			"host": "10.241.52.8:5601",
			"accept": "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2",
			"connection": "keep-alive"
		},
		"remoteAddress": "10.241.52.8",
		"userAgent": "10.241.52.8"
	},
	"res": {
		"statusCode": 503,
		"responseTime": 216,
		"contentLength": 9
	},
	"message": "GET /api/reporting/jobs/download/j1o25dhl0nhrf5f2c87jku08 503 216ms - 9.0B"
}

Then I do curl -k -u elastic:changeme -H "kbn-xsrf: reporting" "https://10.241.52.8:5601/api/reporting/jobs/download/j1o25dhl0nhrf5f2c87jku08" and get this error:

{"statusCode":500,"error":"Internal Server Error","message":"An internal server error occurred"}

I'm stumped at what is causing the error or how to find the cause of the error.

LeeDr · April 26, 2017, 11:03pm

When you say "running a report manually" what exactly do you mean? Are you getting the "Generation URL" and doing something with that? Can you show the actual command you're using?

Or are you using Watcher to generate the report? If so, can you show the watch?

Does just clicking the Generate Printable PDF button in Kibana work?

Regards,
Lee

banderson · April 27, 2017, 2:26pm

To run a report manually, I send a POST _xpack/watcher/watch/cisco_ios_severity_dashboard/_execute request using the Dev Tools Console in Kibana.

My watch is

{
  "found": true,
  "_id": "cisco_ios_severity_dashboard",
  "_status": {
    "version": 12,
    "state": {
      "active": true,
      "timestamp": "2017-04-23T16:16:18.226Z"
    },
    "last_checked": "2017-04-27T06:00:00.074Z",
    "last_met_condition": "2017-04-27T06:00:00.074Z",
    "actions": {
      "send_email": {
        "ack": {
          "timestamp": "2017-04-23T16:16:59.083Z",
          "state": "ackable"
        },
        "last_execution": {
          "timestamp": "2017-04-27T06:00:00.074Z",
          "successful": true
        },
        "last_successful_execution": {
          "timestamp": "2017-04-27T06:00:00.074Z",
          "successful": true
        }
      }
    }
  },
  "watch": {
    "trigger": {
      "schedule": {
        "daily": {
          "at": [
            "06:00"
          ]
        }
      }
    },
    "input": {
      "none": {}
    },
    "condition": {
      "always": {}
    },
    "actions": {
      "send_email": {
        "email": {
          "profile": "standard",
          "attachments": {
            "Cisco_IOS_Severity.pdf": {
              "reporting": {
                "url": "https://10.241.52.8:5601/api/reporting/generate/dashboard/f1cf65b0-1fa7-11e7-8b6d-7b620aec2238?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-24h,mode:quick,to:now))&_a=(filters:!(),options:(darkTheme:!f),panels:!((col:7,id:%27785e7d20-1fa6-11e7-8b6d-7b620aec2238%27,panelIndex:1,row:4,size_x:6,size_y:3,type:visualization),(col:1,id:c29df220-1fa7-11e7-8b6d-7b620aec2238,panelIndex:2,row:1,size_x:6,size_y:3,type:visualization),(col:7,id:%27041f9710-1faa-11e7-8b6d-7b620aec2238%27,panelIndex:3,row:1,size_x:6,size_y:3,type:visualization),(col:1,id:%272bf2f4d0-1faf-11e7-b3e8-7369c02ae27b%27,panelIndex:4,row:4,size_x:6,size_y:3,type:visualization),(col:1,id:%27590cc620-2398-11e7-8b6d-7b620aec2238%27,panelIndex:5,row:7,size_x:6,size_y:3,type:visualization),(col:7,id:%2715c30400-2399-11e7-8b6d-7b620aec2238%27,panelIndex:6,row:7,size_x:6,size_y:3,type:visualization)),query:(query_string:(analyze_wildcard:!t,query:%27*%27)),title:%27Cisco+IOS+Severity%27,uiState:(P-1:(vis:(params:(sort:(columnIndex:!n,direction:!n)))),P-2:(vis:(params:(sort:(columnIndex:!n,direction:!n)))),P-3:(vis:(params:(sort:(columnIndex:!n,direction:!n)))),P-4:(vis:(params:(sort:(columnIndex:!n,direction:!n)))),P-5:(vis:(params:(sort:(columnIndex:!n,direction:!n)))),P-6:(vis:(params:(sort:(columnIndex:!n,direction:!n))))))",
                "retries": 6,
                "interval": "10m",
                "auth": {
                  "basic": {
                    "username": "elastic"
                  }
                }
              }
            }
          },
          "to": [
            "bill.anderson@oa.mo.gov"
          ],
          "subject": "Kibana Cisco IOS Severity Report",
          "body": {
            "html": "Report is attached"
          }
        }
      }
    }
  }
}

Clicking the Generate Printable PDF button in Kibana does work. The watch runs successfully at the scheduled time. It just doesn't work when using the POST _xpack/watcher/watch/<watch id>/_execute API request.

spinscale · April 29, 2017, 2:07pm

The URL in the watch looks like a visualization and not like a PDF report. Did you ensure that you can use curl or another cmd line tool in order to download the PDF manually before putting it into a watch?

--Alex

LeeDr · May 1, 2017, 4:33pm

Without Watcher involved I can generate a PDF report and download it like this;

This POST has the "Generation URL" from Kibana;

curl -XPOST -k -u elastic:changeit -H "kbn-xsrf: reporting"  'https://localhost:5601/api/reporting/generate/dashboard/41585f30-2e88-11e7-ab33-956973f3c5b8?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-15m,mode:quick,to:now))&_a=(filters:!(),options:(darkTheme:!f),panels:!((col:4,id:Web-transactions,panelIndex:1,row:1,size_x:9,size_y:4,type:visualization),(col:1,id:HTTP-error-codes,panelIndex:2,row:8,size_x:6,size_y:3,type:visualization),(col:7,id:HTTP-error-codes-evolution,panelIndex:3,row:8,size_x:6,size_y:3,type:visualization),(col:1,id:Navigation,panelIndex:4,row:1,size_x:3,size_y:4,type:visualization),(col:1,id:Total-number-of-HTTP-transactions,panelIndex:5,row:5,size_x:3,size_y:3,type:visualization),(col:4,id:HTTP-codes-for-the-top-queries,panelIndex:6,row:5,size_x:9,size_y:3,type:visualization),(col:1,id:Top-10-HTTP-requests,panelIndex:7,row:11,size_x:12,size_y:5,type:visualization)),query:(query_string:(analyze_wildcard:!t,query:%27*%27)),timeRestore:!f,title:%27Packetbeat+HTTP+1%27,uiState:(P-7:(vis:(params:(sort:(columnIndex:!n,direction:!n))))),viewMode:view)'

And this gets the download with curl and redirects it to a pdf file (wget might be more appropriate). I got the URL from the Kibana log (its also in the response from the POST).

curl -k -u elastic:changeit 'https://localhost:5601/api/reporting/jobs/download/j26bv6ud01jx8f5fe5fnexbv'

banderson · May 4, 2017, 4:23pm

The problem I was having turned out to be a timeout issue. My watches are executing and the PDF attachment is emailed.

system · June 1, 2017, 4:30pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.