Timeline Template Save Not Working

When creating a new Timeline Template in Elastic Security I cannot save the timeline. I've been encountering this issue for several versions now, latest being 8.12.2.

Clicking the Save button, the progress indicator just keeps looping and console in browser shows error. On rare occasions such as duplicating the template it does work. I haven't been able to find any reliable pattern in the behavior really.

It's not a permission issue as I get the same results with the elastic user and it also seems to affect both default and custom spaces.

Hey @j91321 ,

I tried to replicate the scenario that you mentioned here but I could not. We had a rare bug where Saving a timeline was failing but it will only happen when 2 users are simultaneusly working on same timeline.

In this case, I was able to save the timeline and Save as new Timeline without any issues.

In your screenshot, I can see that you are getting api/timeline endpoint as 404 Not Found, which makes me think that there is some issue with your kibana backend and it is not healthy because the API endpoint for PATCH method should be well and healthy.

Could you please perform below steps:

Go to address: https://<your kibana instance>/api/status when you are logged in and share the json output.

It will inform us of the status of each service.

Thanks for the response @Jatin_Kathuria

Interesting, I've been having this exact same problem on multiple clusters in our environment. It affects both the testing cluster and the production one. However they are deployed in a similar manner so the issue may persist because of that.

Here is the /api/status as far as I can tell the Kibana instance is healthy.

{"name":"xxx-kibana01.local","uuid":"55c13da6-f4ac-4ea8-ab02-659de08c50dc","version":{"number":"8.12.2","build_hash":"f5bd489c5ff9c676c4f861c42da6ea99ae350832","build_number":70281,"build_snapshot":false,"build_date":"2024-02-19T12:06:36.344Z"},"status":{"overall":{"level":"available","summary":"All services and plugins are available"},"core":{"elasticsearch":{"level":"available","summary":"Elasticsearch is available","meta":{"warningNodes":[],"incompatibleNodes":[]}},"savedObjects":{"level":"available","summary":"SavedObjects service has completed migrations and is available","meta":{"migratedIndices":{"migrated":0,"skipped":0,"patched":6}}}},"plugins":{"alerting":{"level":"available","summary":"Alerting is (probably) ready","reported":true},"triggersActionsUi":{"level":"available","summary":"All services and plugins are available"},"discover":{"level":"available","summary":"All services and plugins are available"},"links":{"level":"available","summary":"All services and plugins are available"},"ruleRegistry":{"level":"available","summary":"All services and plugins are available"},"stackAlerts":{"level":"available","summary":"All services and plugins are available"},"stackConnectors":{"level":"available","summary":"All services and plugins are available"},"transform":{"level":"available","summary":"All services and plugins are available"},"cases":{"level":"available","summary":"All services and plugins are available"},"dataVisualizer":{"level":"available","summary":"All services and plugins are available"},"discoverEnhanced":{"level":"available","summary":"All services and plugins are available"},"reporting":{"level":"available","summary":"All services and plugins are available"},"aiops":{"level":"available","summary":"All services and plugins are available"},"canvas":{"level":"available","summary":"All services and plugins are available"},"cloudSecurityPosture":{"level":"available","summary":"All services and plugins are available"},"indexManagement":{"level":"available","summary":"All services and plugins are available"},"logExplorer":{"level":"available","summary":"All services and plugins are available"},"observabilityShared":{"level":"available","summary":"All services and plugins are available"},"osquery":{"level":"available","summary":"All services and plugins are available"},"threatIntelligence":{"level":"available","summary":"All services and plugins are available"},"timelines":{"level":"available","summary":"All services and plugins are available"},"datasetQuality":{"level":"available","summary":"All services and plugins are available"},"indexLifecycleManagement":{"level":"available","summary":"All services and plugins are available"},"metricsDataAccess":{"level":"available","summary":"All services and plugins are available"},"ml":{"level":"available","summary":"All services and plugins are available"},"remoteClusters":{"level":"available","summary":"All services and plugins are available"},"rollup":{"level":"available","summary":"All services and plugins are available"},"sessionView":{"level":"available","summary":"All services and plugins are available"},"textBasedLanguages":{"level":"available","summary":"All services and plugins are available"},"assetManager":{"level":"available","summary":"All services and plugins are available"},"crossClusterReplication":{"level":"available","summary":"All services and plugins are available"},"elasticAssistant":{"level":"available","summary":"All services and plugins are available"},"kubernetesSecurity":{"level":"available","summary":"All services and plugins are available"},"observabilityAIAssistant":{"level":"available","summary":"All services and plugins are available"},"aiAssistantManagementObservability":{"level":"available","summary":"All services and plugins are available"},"cloudDefend":{"level":"available","summary":"All services and plugins are available"},"exploratoryView":{"level":"available","summary":"All services and plugins are available"},"logsShared":{"level":"available","summary":"All services and plugins are available"},"enterpriseSearch":{"level":"available","summary":"All services and plugins are available"},"observability":{"level":"available","summary":"All services and plugins are available"},"observabilityLogExplorer":{"level":"available","summary":"All services and plugins are available"},"securitySolution":{"level":"available","summary":"All services and plugins are available"},"apm":{"level":"available","summary":"All services and plugins are available"},"infra":{"level":"available","summary":"All services and plugins are available"},"observabilityOnboarding":{"level":"available","summary":"All services and plugins are available"},"securitySolutionEss":{"level":"available","summary":"All services and plugins are available"},"synthetics":{"level":"available","summary":"All services and plugins are available"},"uptime":{"level":"available","summary":"All services and plugins are available"},"monitoring":{"level":"available","summary":"All services and plugins are available"},"upgradeAssistant":{"level":"available","summary":"All services and plugins are available"},"ux":{"level":"available","summary":"All services and plugins are available"},"logstash":{"level":"available","summary":"All services and plugins are available"},"fleet":{"level":"available","summary":"Fleet is available","reported":true},"bfetch":{"level":"available","summary":"All services are available"},"contentManagement":{"level":"available","summary":"All services are available"},"customIntegrations":{"level":"available","summary":"All services are available"},"esUiShared":{"level":"available","summary":"All services are available"},"expressions":{"level":"available","summary":"All services are available"},"fieldFormats":{"level":"available","summary":"All services are available"},"ftrApis":{"level":"available","summary":"All services are available"},"kibanaReact":{"level":"available","summary":"All services are available"},"kibanaUtils":{"level":"available","summary":"All services are available"},"licenseApiGuard":{"level":"available","summary":"All services are available"},"monitoringCollection":{"level":"available","summary":"All services are available"},"noDataPage":{"level":"available","summary":"All services are available"},"runtimeFields":{"level":"available","summary":"All services are available"},"savedObjectsFinder":{"level":"available","summary":"All services are available"},"screenshotMode":{"level":"available","summary":"All services are available"},"share":{"level":"available","summary":"All services are available"},"translations":{"level":"available","summary":"All services are available"},"unifiedHistogram":{"level":"available","summary":"All services are available"},"urlForwarding":{"level":"available","summary":"All services are available"},"banners":{"level":"available","summary":"All services and plugins are available"},"customBranding":{"level":"available","summary":"All services and plugins are available"},"devTools":{"level":"available","summary":"All services and plugins are available"},"features":{"level":"available","summary":"All services and plugins are available"},"globalSearch":{"level":"available","summary":"All services and plugins are available"},"inspector":{"level":"available","summary":"All services and plugins are available"},"mapsEms":{"level":"available","summary":"All services and plugins are available"},"newsfeed":{"level":"available","summary":"All services and plugins are available"},"usageCollection":{"level":"available","summary":"All services and plugins are available"},"cloud":{"level":"available","summary":"All services and plugins are available"},"dataViews":{"level":"available","summary":"All services and plugins are available"},"globalSearchProviders":{"level":"available","summary":"All services and plugins are available"},"kibanaUsageCollection":{"level":"available","summary":"All services and plugins are available"},"telemetryCollectionManager":{"level":"available","summary":"All services and plugins are available"},"guidedOnboarding":{"level":"available","summary":"All services and plugins are available"},"screenshotting":{"level":"available","summary":"All services and plugins are available"},"telemetryCollectionXpack":{"level":"available","summary":"All services and plugins are available"},"uiActions":{"level":"available","summary":"All services and plugins are available"},"home":{"level":"available","summary":"All services and plugins are available"},"console":{"level":"available","summary":"All services and plugins are available"},"grokdebugger":{"level":"available","summary":"All services and plugins are available"},"management":{"level":"available","summary":"All services and plugins are available"},"painlessLab":{"level":"available","summary":"All services and plugins are available"},"searchprofiler":{"level":"available","summary":"All services and plugins are available"},"advancedSettings":{"level":"available","summary":"All services and plugins are available"},"aiAssistantManagementSelection":{"level":"available","summary":"All services and plugins are available"},"cloudDataMigration":{"level":"available","summary":"All services and plugins are available"},"spaces":{"level":"available","summary":"All services and plugins are available"},"eventLog":{"level":"available","summary":"All services and plugins are available"},"security":{"level":"available","summary":"All services and plugins are available"},"cloudLinks":{"level":"available","summary":"All services and plugins are available"},"data":{"level":"available","summary":"All services and plugins are available"},"encryptedSavedObjects":{"level":"available","summary":"All services and plugins are available"},"files":{"level":"available","summary":"All services and plugins are available"},"lists":{"level":"available","summary":"All services and plugins are available"},"snapshotRestore":{"level":"available","summary":"All services and plugins are available"},"telemetry":{"level":"available","summary":"All services and plugins are available"},"actions":{"level":"available","summary":"All services and plugins are available"},"apmDataAccess":{"level":"available","summary":"All services and plugins are available"},"charts":{"level":"available","summary":"All services and plugins are available"},"dataViewEditor":{"level":"available","summary":"All services and plugins are available"},"dataViewFieldEditor":{"level":"available","summary":"All services and plugins are available"},"ecsDataQualityDashboard":{"level":"available","summary":"All services and plugins are available"},"fileUpload":{"level":"available","summary":"All services and plugins are available"},"filesManagement":{"level":"available","summary":"All services and plugins are available"},"licenseManagement":{"level":"available","summary":"All services and plugins are available"},"savedObjects":{"level":"available","summary":"All services and plugins are available"},"telemetryManagementSection":{"level":"available","summary":"All services and plugins are available"},"unifiedDocViewer":{"level":"available","summary":"All services and plugins are available"},"ingestPipelines":{"level":"available","summary":"All services and plugins are available"},"notifications":{"level":"available","summary":"All services and plugins are available"},"savedObjectsTaggingOss":{"level":"available","summary":"All services and plugins are available"},"watcher":{"level":"available","summary":"All services and plugins are available"},"savedObjectsManagement":{"level":"available","summary":"All services and plugins are available"},"savedObjectsTagging":{"level":"available","summary":"All services and plugins are available"},"embeddable":{"level":"available","summary":"All services and plugins are available"},"globalSearchBar":{"level":"available","summary":"All services and plugins are available"},"unifiedSearch":{"level":"available","summary":"All services and plugins are available"},"dataViewManagement":{"level":"available","summary":"All services and plugins are available"},"imageEmbeddable":{"level":"available","summary":"All services and plugins are available"},"navigation":{"level":"available","summary":"All services and plugins are available"},"presentationUtil":{"level":"available","summary":"All services and plugins are available"},"savedSearch":{"level":"available","summary":"All services and plugins are available"},"uiActionsEnhanced":{"level":"available","summary":"All services and plugins are available"},"controls":{"level":"available","summary":"All services and plugins are available"},"embeddableEnhanced":{"level":"available","summary":"All services and plugins are available"},"expressionError":{"level":"available","summary":"All services and plugins are available"},"expressionImage":{"level":"available","summary":"All services and plugins are available"},"expressionMetric":{"level":"available","summary":"All services and plugins are available"},"expressionRepeatImage":{"level":"available","summary":"All services and plugins are available"},"expressionRevealImage":{"level":"available","summary":"All services and plugins are available"},"expressionShape":{"level":"available","summary":"All services and plugins are available"},"graph":{"level":"available","summary":"All services and plugins are available"},"kibanaOverview":{"level":"available","summary":"All services and plugins are available"},"urlDrilldown":{"level":"available","summary":"All services and plugins are available"},"visualizations":{"level":"available","summary":"All services and plugins are available"},"dashboard":{"level":"available","summary":"All services and plugins are available"},"eventAnnotation":{"level":"available","summary":"All services and plugins are available"},"expressionGauge":{"level":"available","summary":"All services and plugins are available"},"expressionHeatmap":{"level":"available","summary":"All services and plugins are available"},"expressionLegacyMetricVis":{"level":"available","summary":"All services and plugins are available"},"expressionMetricVis":{"level":"available","summary":"All services and plugins are available"},"expressionPartitionVis":{"level":"available","summary":"All services and plugins are available"},"expressionTagcloud":{"level":"available","summary":"All services and plugins are available"},"visDefaultEditor":{"level":"available","summary":"All services and plugins are available"},"visTypeHeatmap":{"level":"available","summary":"All services and plugins are available"},"visTypeMarkdown":{"level":"available","summary":"All services and plugins are available"},"visTypeMetric":{"level":"available","summary":"All services and plugins are available"},"visTypeTable":{"level":"available","summary":"All services and plugins are available"},"visTypeTagcloud":{"level":"available","summary":"All services and plugins are available"},"visTypeTimelion":{"level":"available","summary":"All services and plugins are available"},"visTypeTimeseries":{"level":"available","summary":"All services and plugins are available"},"visTypeVega":{"level":"available","summary":"All services and plugins are available"},"visTypeVislib":{"level":"available","summary":"All services and plugins are available"},"visTypeXy":{"level":"available","summary":"All services and plugins are available"},"dashboardEnhanced":{"level":"available","summary":"All services and plugins are available"},"expressionXY":{"level":"available","summary":"All services and plugins are available"},"inputControlVis":{"level":"available","summary":"All services and plugins are available"},"visTypeGauge":{"level":"available","summary":"All services and plugins are available"},"visTypePie":{"level":"available","summary":"All services and plugins are available"},"lens":{"level":"available","summary":"All services and plugins are available"},"eventAnnotationListing":{"level":"available","summary":"All services and plugins are available"},"maps":{"level":"available","summary":"All services and plugins are available"},"licensing":{"level":"available","summary":"License fetched","reported":true},"taskManager":{"level":"available","summary":"Task Manager is healthy","reported":true}}},"metrics":{"last_updated":"2024-06-25T09:06:44.768Z","collection_interval_in_millis":5000,"os":{"platform":"linux","platformRelease":"linux-5.10.0-28-amd64","load":{"1m":0.09,"5m":0.11,"15m":0.18},"memory":{"total_in_bytes":16774041600,"free_in_bytes":14894469120,"used_in_bytes":1879572480},"uptime_in_millis":8985555720,"distro":"Debian","distroRelease":"Debian-11","cpu":{"cfs_quota_micros":-1,"cfs_period_micros":100000,"control_group":"/system.slice/kibana.service","stat":{"number_of_elapsed_periods":0,"number_of_times_throttled":0,"time_throttled_nanos":0}},"cpuacct":{"control_group":"/system.slice/kibana.service","usage_nanos":53410238993},"cgroup_memory":{"current_in_bytes":1149140992,"swap_current_in_bytes":0}},"process":{"memory":{"heap":{"total_in_bytes":570101760,"used_in_bytes":404586448,"size_limit":4345298944},"resident_set_size_in_bytes":907059200,"array_buffers_in_bytes":1013877,"external_in_bytes":2310709},"pid":463607,"event_loop_delay":10.12601131707317,"event_loop_delay_histogram":{"min":9.09312,"max":13.574143,"mean":10.12601131707317,"exceeds":0,"stddev":0.5256089265059033,"fromTimestamp":"2024-06-25T09:06:39.766Z","lastUpdatedAt":"2024-06-25T09:06:44.765Z","percentiles":{"50":9.895935,"75":10.674175,"95":10.911743,"99":11.083775}},"event_loop_utilization":{"active":294.8782836198807,"idle":4705.28690803051,"utilization":0.05897370833113436},"uptime_in_millis":429600780.03372896},"processes":[{"memory":{"heap":{"total_in_bytes":570101760,"used_in_bytes":404586448,"size_limit":4345298944},"resident_set_size_in_bytes":907059200,"array_buffers_in_bytes":1013877,"external_in_bytes":2310709},"pid":463607,"event_loop_delay":10.12601131707317,"event_loop_delay_histogram":{"min":9.09312,"max":13.574143,"mean":10.12601131707317,"exceeds":0,"stddev":0.5256089265059033,"fromTimestamp":"2024-06-25T09:06:39.766Z","lastUpdatedAt":"2024-06-25T09:06:44.765Z","percentiles":{"50":9.895935,"75":10.674175,"95":10.911743,"99":11.083775}},"event_loop_utilization":{"active":294.8782836198807,"idle":4705.28690803051,"utilization":0.05897370833113436},"uptime_in_millis":429600780.03372896}],"response_times":{"avg_in_millis":44.75,"max_in_millis":61},"concurrent_connections":10,"requests":{"disconnects":0,"total":4,"statusCodes":{"200":3,"302":1},"status_codes":{"200":3,"302":1}},"elasticsearch_client":{"totalActiveSockets":1,"totalIdleSockets":10,"totalQueuedRequests":0}}}

I've managed to track down the issue, it turns out that there was security hardening done on a reverse proxy that's serving the Kibana instance and it was blocking this specific request. Removing it solved the issue.

Thanks for the information. I am glad the issue is now resolved.