Timelion: reduce_search_phase_exception

Elastic Stack Kibana
1

Hi, when I plug any new winlogbeat agent to Logstash, Kibana starts showing the following error message. I'm over an Ubuntu 16.06 system, and using the following versions:

LS: 5.4.0
ES: 5.3.0
KB: 5.1.1

  Error:  in cell #1: [reduce_search_phase_exception] [reduce] 
        at throwWithCell (/usr/share/kibana/src/core_plugins/timelion/server/handlers/chain_runner.js:30:11)
        at /usr/share/kibana/src/core_plugins/timelion/server/handlers/chain_runner.js:156:13
        at arrayEach (/usr/share/kibana/node_modules/lodash/index.js:1289:13)
        at Function.<anonymous> (/usr/share/kibana/node_modules/lodash/index.js:3345:13)
        at /usr/share/kibana/src/core_plugins/timelion/server/handlers/chain_runner.js:148:9
        at bound (domain.js:280:14)
        at runBound (domain.js:293:12)
        at tryCatcher (/usr/share/kibana/node_modules/bluebird/js/main/util.js:26:23)
        at Promise._settlePromiseFromHandler (/usr/share/kibana/node_modules/bluebird/js/main/promise.js:503:31)
        at Promise._settlePromiseAt (/usr/share/kibana/node_modules/bluebird/js/main/promise.js:577:18)
        at Promise._settlePromises (/usr/share/kibana/node_modules/bluebird/js/main/promise.js:693:14)
        at Async._drainQueue (/usr/share/kibana/node_modules/bluebird/js/main/async.js:123:16)
        at Async._drainQueues (/usr/share/kibana/node_modules/bluebird/js/main/async.js:133:10)
        at Immediate.Async.drainQueues (/usr/share/kibana/node_modules/bluebird/js/main/async.js:15:14)
        at runCallback (timers.js:637:20)
        at tryOnImmediate (timers.js:610:5)
2

Hi @dreadlocked1,

first I want to point out that only the combination of Kibana 5.1.1 with Elasticsearch 5.1.x is supported. I would recommend to upgrade both to 5.4.3.

Regarding the error, is it possible that lucene expressions are disabled on your cluster? They are required for timelion to work. Please track Issue #8829 for updates and feel free to add your comments to it.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.