Timelion: Not Found Error in visualization Not Found

[galexander87 (Greg)]

I am trying to figure out how to get kibana to let me visual time periods longer than a few minutes.

I get the following error when I query timelion data longer than 15 minutes in Kibana Dashboards

#top banner
Timelion: Not Found

#Bottom right
Error in visualization
Not Found

Additional Details:
I am using Metricbeat's apache module to collect busy worker data and visualize it using kibana and timelion. Metricbeat ships the data to Elasticsearch directly and Kibana queries elasticsearch.

This is one of many instances where Kibana attempts to load data older than an hour or so and ends up throwing errors.

I am running version 7.0.0 for all of the Elastic components.

As of this writing I have one host with the following running on it:

Elasticsearch
Disk Available: 50.89% 5.5TB/10.7TB
JVM Heap: 73.92% 20.0GB / 25.6 GB
Indices: 173
Documents: 21+ Billion
Disk Usage: 4.9 TB
Primary Shards 173

Kibana
Memory Usage 18.40% 268MB / 1.4 GB

Logstash
Events Received 2.4 Billion
JVM Heap 14.65% 3.8 GB / 25.6 GB

[Marius_Dragomir]

Can you add a screenshot for this error? and maybe the query that you're using in Timelion. That ES JVM heap is a bit high as well, so that might be a problem too.

[galexander87 (Greg)]

The timelion visualization is the following:
.es(q='host.hostname:my.host.hostname', metric='avg:apache.stat.workers.busy').if(gt, 2000, .es(q=q='host.hostname:my.host.hostname', metric='avg:apache.stat.workers.busy'), null).bars(3).color(red).label('SEVERE - Worker Count > 2000'), .es(q='host.hostname:my.host.hostname', metric='avg:apache.stat.workers.busy').if(gt, 1000, .es(q=q='host.hostname:my.host.hostname', metric='avg:apache.stat.workers.busy'), null).bars(3).color(red).label('HIGH - Worker Count > 1000'), .es(q='host.hostname:my.host.hostname', metric='avg:apache.stat.workers.busy').if(lte, 999, .es(q=q='host.hostname:my.host.hostname', metric='avg:apache.stat.workers.busy'), null).bars(3).color(red).label('NORMAN - Worker Count < 1000')

However, the timelion error in the dashboard view doesnt give me more info for the error. It just says: Timelion: Not Found

This is a similar error from the Discover tab where I query for a longer period (this time, 2 days of data and I am querying for clientip : <IP Address> This error had more info:

Discover: Not Found
Error: Not Found

SearchError@https://my.kibana.website.com/bundles/commons.bundle.js:3:298045
_callee2$/<.searching</<@https://my.kibana.website.com/bundles/commons.bundle.js:4:324908
processQueue@https://my.kibana.website.com/built_assets/dlls/vendors/bundle.dll.js:427:199687
vendors</qFactory/scheduleProcessQueue/<@https://my.kibana.website.com/built_assets/dlls/vendors/bundle.dll.js:427:200650
vendors</$RootScopeProvider/this.$get</Scope.prototype.$digest@https://my.kibana.website.com/built_assets/dlls/vendors/bundle.dll.js:427:210412
vendors</$RootScopeProvider/this.$get</Scope.prototype.$apply@https://my.kibana.website.com/built_assets/dlls/vendors/bundle.dll.js:427:213208
done@https://my.kibana.website.com/built_assets/dlls/vendors/bundle.dll.js:427:132706
completeRequest@https://my.kibana.website.com/built_assets/dlls/vendors/bundle.dll.js:427:136329
requestLoaded@https://my.kibana.website.com/built_assets/dlls/vendors/bundle.dll.js:427:135225