# SIEM error unexpected token \<in JSON at position 0

**URL:** <https://discuss.elastic.co/t/siem-error-unexpected-token-in-json-at-position-0/252327>\
**Category:** SIEM\
**Created:** [October 16, 2020, 10:08am UTC](https://discuss.elastic.co/t/siem-error-unexpected-token-in-json-at-position-0/252327 "2020-10-16T10:08:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Post date:** [October 16, 2020, 10:08am UTC](https://discuss.elastic.co/t/siem-error-unexpected-token-in-json-at-position-0/252327/1 "2020-10-16T10:08:59Z")

</div>

Hi all  
I currently have a very anoying problems  
Everytime i went to SIEM app, they load for sometime and then the system popup a error `unexpected token <in JSON at position 0` like 2 time, one for network error and one are visualization error. both have the json error above, before the error appear i cannot do some stuff on SIEM, it is like it trying to load data for me to work.  
After the error appear then i can interact with the system again without any problems, but it still takes some time for that to happen and it is very anoying, Can anybody help me.  
btw i have tried to increase timeout up to 10m and the problems still persisted.

Thanks you for your time.

---

<div class="post-metadata">

**Author:** ![AngelaChuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/angelachuang/32/49719_2.png) [@AngelaChuang](https://discuss.elastic.co/u/AngelaChuang)\
**Post date:** [October 16, 2020, 3:08pm UTC](https://discuss.elastic.co/t/siem-error-unexpected-token-in-json-at-position-0/252327/2 "2020-10-16T15:08:50Z")

</div>

Hello @lusynda,

Sorry to hear that. I'd like to understand more about your case. Could you please which page you usually land on SIEM app? Could you please check if you have saved any query? Have you ever imported / created any custom timeline templates or rules to SIEM app or updated Advanced settings? Thanks 🙂

---

<div class="post-metadata">

**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Post date:** [October 17, 2020, 2:53am UTC](https://discuss.elastic.co/t/siem-error-unexpected-token-in-json-at-position-0/252327/3 "2020-10-17T02:53:39Z")

</div>

- I usually use detection and network tab.
- I do have a lots of saved query, and a few custom rule and also i do change a bit in the Advanced settings but i do not thinks that is the problems.

---

<div class="post-metadata">

**Author:** ![yctercero](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yctercero/32/68560_2.png) [@yctercero](https://discuss.elastic.co/u/yctercero)\
**Post date:** [October 19, 2020, 1:52pm UTC](https://discuss.elastic.co/t/siem-error-unexpected-token-in-json-at-position-0/252327/4 "2020-10-19T13:52:45Z")

</div>

Hey @lusynda !

What version of Kibana are you on? Would it be possible for you to list out the exact steps that reliably reproduce what you are seeing? Are you using any custom indexes?

Best,  
Yara

---

<div class="post-metadata">

**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Post date:** [October 20, 2020, 12:54am UTC](https://discuss.elastic.co/t/siem-error-unexpected-token-in-json-at-position-0/252327/5 "2020-10-20T00:54:10Z")

</div>

- Yes well the whole cluster version are 7.9.0.
- The step are just how when i usually started to create an rule or change some of them: i went to siem app, click on detection tab, then after a while then the error will appear.
- most of the indexes iam using are custom indexes.

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [October 20, 2020, 10:44pm UTC](https://discuss.elastic.co/t/siem-error-unexpected-token-in-json-at-position-0/252327/6 "2020-10-20T22:44:59Z")

</div>

Hi @lusynda, if you have too much data per 24 hour time block that could be causing a lot of timeout issues depending on several factors such as how much data you're ingesting vs how many ES nodes you have.

Under Stack Management -\> Advanced Settings you can set your time range to be smaller than the default 24 hours such as 1 hour or 15 minutes. It's default is 24 hours which could be too much data to display all at once if you have a lot of data over a 24 hour time span:

 ![Screen Shot 2020-10-20 at 4.41.51 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/7/77d900c14fa205f381c76ef3fb60cd79c3c07e2f.png)

I would start there and decrease that number until you can view the pages without errors. A second part to this is for 7.9.1+ we have implemented several perf improvements that might help you out as well if you're on just 7.9.0 I would recommend upgrading to the latest 7.9.2:

> <https://github.com/elastic/kibana/pull/75716>

  

> <https://github.com/elastic/kibana/pull/75718>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2020, 10:45pm UTC](https://discuss.elastic.co/t/siem-error-unexpected-token-in-json-at-position-0/252327/7 "2020-11-17T22:45:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.