# Reticulating Splines - ES6.3.2 w/Kibana on ECE

**URL:** <https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989>\
**Category:** Elastic Cloud Enterprise (ECE)\
**Created:** [August 3, 2018, 10:46pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989 "2018-08-03T22:46:42Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![kcurtis](https://avatars.discourse-cdn.com/v4/letter/k/8491ac/32.png) [@kcurtis](https://discuss.elastic.co/u/kcurtis)\
**Post date:** [August 3, 2018, 10:46pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/1 "2018-08-03T22:46:42Z")

</div>

I'm posting this in ECE as the ES clusters live inside ECE, but that may or may not be the issue. Currently working through a ticket but no resolutions yet.

Whenever I built a new ES Cluster 6.3.2 with Kibana enabled, I get "Reticulating Splines.." on the screen in Kibana. This appears in "Management" and "Index Patterns". It just sits there and spins and you can never create an index pattern.

Normal operations in Dev Console are fine. Anyone else seeing this?

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [August 7, 2018, 2:27pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/2 "2018-08-07T14:27:31Z")

</div>

Did you get any resolution on this? I had a quick scan through our internal support issues and couldn't find any mention of "reticulating splines" (which google suggests is a "joke" error, just meaning the server is doing something)

I've never seen this before fwiw, does the HTTP traffic (ie seen via the network console) give any clues? My guess is that it's waiting for some response from the server which never comes back, but knowing what the request is would help narrow it down

---

<div class="post-metadata">

**Author:** ![kcurtis](https://avatars.discourse-cdn.com/v4/letter/k/8491ac/32.png) [@kcurtis](https://discuss.elastic.co/u/kcurtis)\
**Post date:** [August 7, 2018, 3:23pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/3 "2018-08-07T15:23:44Z")

</div>

Good call. I do see errors in chrome\developertools\console. (replacing our private dns name space for confidentiality.)

INFO: 2018-08-07T15:16:42Z  
Adding connection to [https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/elasticsearch](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/elasticsearch)

:9243/bundles/kibana.bundle.js:7 setting active api to [es\_5\_0]  
:9243/elasticsearch/_/\_search:1 Failed to load resource: the server responded with a status of 403 ()  
:9243/bundles/vendors.bundle.js:3 Promise: Detected an unhandled Promise rejection.  
Authorization Exception :: {"path":"/_/\_search","query":{},"body":"{"size":0,"aggs":{"indices":{"terms":{"field":"\_index","size":200}}}}","statusCode":403,"response":"\r\n403 Forbidden\r\n\<body bgcolor="white"\>\r\n

# 403 Forbidden
\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n"}  
:9243/bundles/vendors.bundle.js:159 Uncaught (in promise) StatusCodeErrorbody: "  
↵403 Forbidden  
↵  
↵
# 403 Forbidden
  
↵  
↵  
↵  
↵  
↵  
↵  
↵  
↵  
↵"displayName: "AuthorizationException"message: "Authorization Exception"path: "/\*/\_search"query: {}response: "  
↵403 Forbidden  
↵  
↵
# 403 Forbidden
  
↵  
↵  
↵  
↵  
↵  
↵  
↵  
↵  
↵"status: 403statusCode: 403toJSON: ƒ ()toString: ƒ ()stack: "Error: Authorization Exception↵ at respond ([https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:159:38552](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:159:38552))↵ at checkRespForFailure ([https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:159:37792](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:159:37792))↵ at [https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:159:47903↵](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:159:47903%E2%86%B5) at processQueue ([https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:134252](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:134252))↵ at [https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:135201↵](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:135201%E2%86%B5) at Scope.$digest ([https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:146077](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:146077))↵ at Scope.$apply ([https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:148856](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:148856))↵ at done ([https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:101124](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:101124))↵ at completeRequest ([https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:106024](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:106024))↵ at XMLHttpRequest.xhr.onload ([https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:106783](https://b0bad4b757d24dbf98d388873b32e80d.ip.my.domain.com:9243/bundles/vendors.bundle.js:133:106783))" **proto** : ErrorAbstract

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [August 7, 2018, 3:54pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/4 "2018-08-07T15:54:17Z")

</div>

Interesting, `403 Forbidden` means that the authenticated user does not have authorization to call `_search`

Are you logging in as `elastic` or a different user?

---

<div class="post-metadata">

**Author:** ![kcurtis](https://avatars.discourse-cdn.com/v4/letter/k/8491ac/32.png) [@kcurtis](https://discuss.elastic.co/u/kcurtis)\
**Post date:** [August 7, 2018, 4:30pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/5 "2018-08-07T16:30:38Z")

</div>

logged in as the elastic user.

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [August 7, 2018, 4:54pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/6 "2018-08-07T16:54:27Z")

</div>

And if you do something like

`curl -k -u elastic:YOUR_PASSWORD -H 'Content-type: application/json' https://ES_CLUSTER_ID.ip.my.domain.com:9243/_search -d '{"size":0,"aggs":{"indices":{"terms":{"field":"_index","size":200}}}}'`, which I think is the exact query that Kibana is failing on, what does it return?

Also probably worth checking out the Kibana logs (eg search for the Kibana cluster id in the logging and monitoring cluster), or they are on disk in `/mnt/data/elastic/RUNNER_ID/services/allocator/container/kibana/KIBANA_ID/logs`, in case there are some errors before that which give a clue as to why `elastic` is failing in this way

---

<div class="post-metadata">

**Author:** ![kcurtis](https://avatars.discourse-cdn.com/v4/letter/k/8491ac/32.png) [@kcurtis](https://discuss.elastic.co/u/kcurtis)\
**Post date:** [August 7, 2018, 5:14pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/7 "2018-08-07T17:14:36Z")

</div>

curl -u 'elastic:blah' -H 'Content-type: application/json' [https://myclusterid.ip.es.mydomain.com:9243/\_search](https://myclusterid.ip.es.mydomain.com:9243/_search) -d {"size":0,"aggs":{"indices":{"terms":{"field":"\_index","size":200}}}}  
{"error":{"root\_cause":[{"type":"json\_parse\_exception","reason":"Unrecognized token 'size': was expecting ('true', 'false' or 'null')\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@722053b8; line: 1, column: 6]"}],"type":"json\_parse\_exception","reason":"Unrecognized token 'size': was expecting ('true', 'false' or 'null')\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@722053b8; line: 1, column: 6]"},"status":500}curl: (3) [globbing] nested brace in column 15  
curl: (3) [globbing] nested brace in column 15

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [August 7, 2018, 6:24pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/8 "2018-08-07T18:24:37Z")

</div>

did you miss `` (single quotes) around the JSON object following `-d`?

---

<div class="post-metadata">

**Author:** ![kcurtis](https://avatars.discourse-cdn.com/v4/letter/k/8491ac/32.png) [@kcurtis](https://discuss.elastic.co/u/kcurtis)\
**Post date:** [August 8, 2018, 6:10pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/9 "2018-08-08T18:10:17Z")

</div>

○ curl -u 'elastic:blah' -H 'Content-type: application/json' [https://mycluster.ip.es.mydomain.com:9243/\_search](https://mycluster.ip.es.mydomain.com:9243/_search) -d '{"size":0,"aggs":{"indices":{"terms":{"field":"\_index","size":200}}}}'  
{"took":12,"timed\_out":false,"\_shards":{"total":53,"successful":53,"skipped":0,"failed":0},"hits":{"total":114305,"max\_score":0.0,"hits":[]},"aggregations":{"indices":{"doc\_count\_error\_upper\_bound":0,"sum\_other\_doc\_count":0,"buckets":[{"key":"metrics-20180805","doc\_count":15840},{"key":"metrics-20180807","doc\_count":15837},{"key":"metrics-20180804","doc\_count":15836},{"key":"metrics-20180806","doc\_count":15754},{"key":"metrics-20180803","doc\_count":15743},{"key":"metrics-20180802","doc\_count":15035},{"key":"metrics-20180808","doc\_count":11979},{"key":"metrics-20180801","doc\_count":2472},{"key":"items","doc\_count":770},{"key":"builds-20180730","doc\_count":520},{"key":"builds-20180716","doc\_count":403},{"key":"builds-20180726","doc\_count":306},{"key":"builds-20180718","doc\_count":256},{"key":"builds-20180725","doc\_count":247},{"key":"builds-20180806","doc\_count":246},{"key":"builds-20180724","doc\_count":232},{"key":"builds-20180713","doc\_count":198},{"key":"builds-20180719","doc\_count":198},{"key":"builds-20180802","doc\_count":192},{"key":"builds-20180801","doc\_count":186},{"key":"builds-20180717","doc\_count":168},{"key":"builds-20180807","doc\_count":166},{"key":"builds-20180720","doc\_count":165},{"key":"builds-20180727","doc\_count":150},{"key":"builds-20180731","doc\_count":139},{"key":"builds-20180803","doc\_count":134},{"key":"builds-20180723","doc\_count":121},{"key":"builds-20180808","doc\_count":117},{"key":"nodes-20180807","doc\_count":116},{"key":"nodes-20180806","doc\_count":98},{"key":"nodes-20180808","doc\_count":97},{"key":"builds-20180712","doc\_count":80},{"key":"nodes-20180803","doc\_count":78},{"key":"nodes-20180802","doc\_count":75},{"key":"builds-20180729","doc\_count":52},{"key":"builds-20180728","doc\_count":42},{"key":"builds-20180722","doc\_count":39},{"key":"builds-20180721","doc\_count":38},{"key":"nodes-20180804","doc\_count":36},{"key":"nodes-20180801","doc\_count":35},{"key":"builds-20180804","doc\_count":28},{"key":"nodes-20180805","doc\_count":27},{"key":"builds-20180715","doc\_count":20},{"key":"builds-20180714","doc\_count":18},{"key":"builds-20180805","doc\_count":14},{"key":".kibana","doc\_count":2}]}}}%

this works.

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [August 8, 2018, 6:17pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/10 "2018-08-08T18:17:09Z")

</div>

That's really strange ... actually if you look in the proxy logs in the logging and monitoring cluster you should see the 403ing request and be able to tell what the URL was and (I think!) what the calling user was

---

<div class="post-metadata">

**Author:** ![kcurtis](https://avatars.discourse-cdn.com/v4/letter/k/8491ac/32.png) [@kcurtis](https://discuss.elastic.co/u/kcurtis)\
**Post date:** [August 8, 2018, 6:42pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/11 "2018-08-08T18:42:37Z")

</div>

Hmm. Well I just found out something interesting. In my ECE PREPROD environment, this happens on "any" flavor of 6.3 cluster. Any version, 6.3.1 6.3.2. In my "PROD" ECE environment, this does not happen. So that tells me there's something up with a configuration somewhere. Okay so now where do I look. aws elb config, security groups, where...

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [August 8, 2018, 8:16pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/12 "2018-08-08T20:16:19Z")

</div>

Can you give more details on what your ECE PREPROD looks like? I can't immediately see what AWS setting could cause this. I think the thing to do is check the following logs:

- The kibana logs in case there is a startup error that is causing a "fake" 403 error subsequently
- The proxy logs to see what endpoint/user exactly is generating a 403

(feel free to (re?) raise this as a ticket incidentally, and I'll update this thread with the TLDR once we figure out what's going on)

---

<div class="post-metadata">

**Author:** ![kcurtis](https://avatars.discourse-cdn.com/v4/letter/k/8491ac/32.png) [@kcurtis](https://discuss.elastic.co/u/kcurtis)\
**Post date:** [August 13, 2018, 2:19pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/13 "2018-08-13T14:19:58Z")

</div>

Problem Found. After searching the proxy logs for "403"s and not finding them, I turned my focus to the aws elb. That was the issue. There was an AWS Waf rule tied to the elb that was generating the 403's. I highly recommend using a tool called "Insomnia" as I was able to see a header presenting the 403's which clearly showed me the aws load balancer was causing the issue.

---

<div class="post-metadata">

**Author:** ![Alex\_Piggott](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_piggott/32/11053_2.png) [@Alex\_Piggott](https://discuss.elastic.co/u/Alex_Piggott)\
**Post date:** [August 13, 2018, 2:36pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/14 "2018-08-13T14:36:13Z")

</div>

@kcurtis - glad you got it working and thanks for sharing the resolution - really appreciate it

Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2018, 2:36pm UTC](https://discuss.elastic.co/t/reticulating-splines-es6-3-2-w-kibana-on-ece/142989/15 "2018-08-27T14:36:20Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.