# The aggregations key is missing from the response, check your permissions for this request **URL:** \ **Category:** Kibana\ **Created:** [November 14, 2019, 4:23pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932 "2019-11-14T16:23:04Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Akhil\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhil_k/32/45475_2.png) [@Akhil\_K](https://discuss.elastic.co/u/Akhil_K)\ **Post date:** [November 14, 2019, 4:23pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/1 "2019-11-14T16:23:04Z")
I am pretty new to ELK stack. We monitor a particular server health using ELK stack. We have Metricbeat which sends statics and based on that we have index created in Elastic. Kibana visualization is created based on this. But from last couple of days we get below error in Kibana. ![visualise](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b69abdf3a205c73671ae0db0dab4bc619b7289aa.jpeg) Observations : 1. We validated Index Management to check if we have data. We could find that there is no issue in streaming as we continue to receive data. 2. When tried to view the index from Discover, got below Request Timeout Error. ![discover](https://us1.discourse-cdn.com/elastic/original/3X/c/c/ccae8ae29ea7400a57e58d3eed66f667d206c797.jpeg) 3. Any query we run in Dev Tools returns Internal Server Error, as like below. We have ELK setup in dockerised env, ie, seperate docker for Elastic, Logstash and Kibana. When I restart the Kibana container alone, Kibana is back normal. But after sometime, I get this error again. Tried below solution, but nothing positive. > [@Kibana The aggregations key is missing from the response ERROR](https://discuss.elastic.co/t/kibana-the-aggregations-key-is-missing-from-the-response-error/147717): > > Hi i just followed this tutorial: [https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-started-elastic-stack.html](https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-started-elastic-stack.html) To set up a little ELK-stack on my Ubuntu VM. I used metricbeats so that i could monitor my VM as practice. My Kibana dashboard is showing me: The request for this panel failed. The aggregations key is missing from the response on all views, so no data is visible. Any idea what could cause this? No Kibana logs whatsoever. What could be the reason. We are stuck with this for sometime. Thanks in advance ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [November 18, 2019, 4:40pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/2 "2019-11-18T16:40:17Z")
Can you look at the elasticsearch and kibana logs when you run your simple test query above? You might use [https://gist.github.com/](https://gist.github.com/) to post long logs. Its likely that either elasticsearch is having problems or kibana is having trouble connecting to elasticsearch. ---
**Author:** ![Akhil\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhil_k/32/45475_2.png) [@Akhil\_K](https://discuss.elastic.co/u/Akhil_K)\ **Post date:** [November 18, 2019, 5:16pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/3 "2019-11-18T17:16:21Z")
Elasticsearch log looks fine as I don't see any issue/error in those. However, in Kibana logs I could notice few logs with Error and statuscode 404 as shared below : [Kibana error logs](https://gist.github.com/akhil-karikunnath/778bf6ce76dfc56a33078754416d7868) There weren't any configuration changes made to my system recently and everything was running fine till last few days. When I pulled the Kibana log, i could figure out only these logs which was repeating. And when we do a container restart, Kibana visualization will be up and these logs wont appear until next time we get issue in visualization. At same time, Elasticsearch logs are consistent and there are no errors in them. ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [November 18, 2019, 7:18pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/4 "2019-11-18T19:18:27Z")
Can you share your kibana config? I'm curious what might be causing this - `Error: Specified object should be an Object or Array` ---
**Author:** ![Akhil\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhil_k/32/45475_2.png) [@Akhil\_K](https://discuss.elastic.co/u/Akhil_K)\ **Post date:** [November 19, 2019, 4:44am UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/5 "2019-11-19T04:44:20Z")
PFB the kibana config : `server.name: kibana` `server.host: "0"` `elasticsearch.url: http://elasticsearch:9200` `xpack.monitoring.ui.container.elasticsearch.enabled: true` As I said earlier, this was the config for sometime and there wasn't any issues so far, until recently. ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [November 20, 2019, 5:51pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/6 "2019-11-20T17:51:31Z")
What do you see in the browser console when the error occurs? which browser and version are you using? I have a hunch that this is a networking problem but I need to gather info to verify that. ---
**Author:** ![Akhil\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhil_k/32/45475_2.png) [@Akhil\_K](https://discuss.elastic.co/u/Akhil_K)\ **Post date:** [November 21, 2019, 6:46am UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/7 "2019-11-21T06:46:48Z")
The console gives Gateway Timeout error. PFB the console view : ![console](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2aab85d17563fa44def3d0807bdd5bc5c3d75766.jpeg) ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [November 21, 2019, 4:58pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/8 "2019-11-21T16:58:38Z")
I don't think that 504 error is related to the request immediately above. Can you show the network tab? Which version of the elastic stack are you running? Which license are you using? ---
**Author:** ![Akhil\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhil_k/32/45475_2.png) [@Akhil\_K](https://discuss.elastic.co/u/Akhil_K)\ **Post date:** [November 21, 2019, 6:26pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/9 "2019-11-21T18:26:42Z")
PFB the network tab : ![network](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2f8dc3004f7738125c87592aaa2454cac9d7e455.jpeg) PFB the network response : [\_bulk\_get](https://gist.github.com/akhil-karikunnath/607444e4cee6b4d1c49f3a43ee12200f) [fields?index=indexname-\*](https://gist.github.com/akhil-karikunnath/10ae22d5dd0189e814d97cc53fa1e78e) [data](https://gist.github.com/akhil-karikunnath/20e927c09c774533c0651b16ffd4e711) Elastic stack version is 6.4.3, and its a Basic license we are holding. ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [November 22, 2019, 6:23pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/10 "2019-11-22T18:23:54Z")
Can you verify that the info you're attempting to view is available in Discover? Thanks for your patience, I understand the importance of resolving this. ---
**Author:** ![Akhil\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhil_k/32/45475_2.png) [@Akhil\_K](https://discuss.elastic.co/u/Akhil_K)\ **Post date:** [November 25, 2019, 6:10am UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/11 "2019-11-25T06:10:05Z")
No. I get "Discover: Request Timeout after 30000ms" error stack as attached below. ![discover_timeout](https://us1.discourse-cdn.com/elastic/original/3X/0/0/003a00d1b13c50ea82765538f98a087e62819745.jpeg) Apologies for the delay in response. Was in a travel. ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [November 25, 2019, 2:02pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/12 "2019-11-25T14:02:23Z")
Lets work on this error for now. Can you find the request timeout in the dev tools network tab? I'd like to see the details of which request was made. Its also worth checking kibana and elasticsearch logs for errors that occurred at the same time. ---
**Author:** ![Akhil\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhil_k/32/45475_2.png) [@Akhil\_K](https://discuss.elastic.co/u/Akhil_K)\ **Post date:** [November 26, 2019, 7:57am UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/13 "2019-11-26T07:57:17Z")
PFB the network tab during the timeout : ![discover_timeout_nw](https://us1.discourse-cdn.com/elastic/original/3X/2/d/2dc7cf2d9142131113dc95cc5ab4f0668088ca5b.jpeg) The request made is to below api : /elasticsearch/\_msearch I couldn't fetch the logs as it would take some time but I guess it would any of 3 logs which we discussed earlier. I am sharing that again below : [Error logs from Kibana shared earlier](https://gist.github.com/akhil-karikunnath/778bf6ce76dfc56a33078754416d7868) ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [November 28, 2019, 5:53am UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/14 "2019-11-28T05:53:26Z")
Can you click on the \_msearch query so we can see the headers and params that are passed? I do need you to look at the kibana and elasticsearch logs to look for corresponding errors. ---
**Author:** ![Akhil\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhil_k/32/45475_2.png) [@Akhil\_K](https://discuss.elastic.co/u/Akhil_K)\ **Post date:** [November 29, 2019, 11:31am UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/15 "2019-11-29T11:31:01Z")
Thanks for the response. PFB the headers : ![headers](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b3e6a55d52c42286ff45d354fcc270cee189d8c2.png) While checking logs, I could not find anything except for the ones shared earlier. That 3 logs are repeating. ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [November 30, 2019, 2:12am UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/16 "2019-11-30T02:12:59Z")
Thanks, while thats the correct view, I need to see the `Request Payload` portion. I should have specified the first time around. Request number 2 - Could you try this with dev tools and tell me what you get? `GET _cluster/health` ---
**Author:** ![Akhil\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhil_k/32/45475_2.png) [@Akhil\_K](https://discuss.elastic.co/u/Akhil_K)\ **Post date:** [December 2, 2019, 6:06am UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/17 "2019-12-02T06:06:04Z")
PFB the Request Payload portion : ![headers_Rq](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9ec1f0cd4be869977a584f2c90b3516f2ca2ccb9.jpeg) Also PFB the response from Devtools when hitting `GET _cluster/health` : ![devtools_header1](https://us1.discourse-cdn.com/elastic/original/3X/4/f/4f218dad9ab6df24e18a64abcc93e9c626d8c519.jpeg) ![devtools_header2](https://us1.discourse-cdn.com/elastic/original/3X/0/7/07c1316919bb9351f2a1f753898d3cbc3c02bda3.jpeg) ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [December 2, 2019, 3:26pm UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/18 "2019-12-02T15:26:49Z")
The fact that we can't get a response from `GET _cluster/health` is concerning. What privileges does your user for kibana have? Is there another account with full privileges? Either your cluster has a problem or kibana is having trouble connecting to your cluster. Can you connect to your es cluster directly? `curl -X GET "localhost:9200/_cluster/health?wait_for_status=yellow&timeout=50s&pretty"` - changing address and port as appropriate. Can you do the same from the machine that kibana is running on? Documentation on the `_cluster/health` endpoint - [https://www.elastic.co/guide/en/elasticsearch/reference/6.4/cluster-health.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/cluster-health.html) ---
**Author:** ![Akhil\_K](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akhil_k/32/45475_2.png) [@Akhil\_K](https://discuss.elastic.co/u/Akhil_K)\ **Post date:** [December 3, 2019, 1:34am UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/19 "2019-12-03T01:34:08Z")
Below is what I get when trying to connect es cluster directly : ![es_nw1](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e493a674d75406b3dc4e192c0cf03fa305cd60e8.jpeg) ![es_nw2](https://us1.discourse-cdn.com/elastic/original/3X/6/7/6756cd7c03dc6e46fc1a2dfab6539a25bcdba916.jpeg) ![es_nw3](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e0d7002c403599c8ba8f3be0c051e78fb6b0a349.jpeg) We have the basic privilege for Kibana. How do we narrow down to confirm if the problem is with cluster or with connection trouble between Kibana and cluster? ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [December 3, 2019, 2:46am UTC](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932/20 "2019-12-03T02:46:57Z")
You ran the command from the browser. Can you try running it from the command line? Can you run that same command directly from the server instance running elasticsearch? Can you check the elasticsearch logs to see if there's a matching error in the logs? [Next page](https://discuss.elastic.co/t/the-aggregations-key-is-missing-from-the-response-check-your-permissions-for-this-request/207932.md?page=2)