Hi community,
I was looking to create a transform to show count of documents aggregated over unique syslog hostnames. So I proceeded to create the transform through the Kibana GUI and encountered an error: Internal Server Error: An internal server error occurred. Check Kibana server logs for details.
While revieving the Kibana logs through my dedicated monitoring instance all I could see was Cannot destructure property 'error' of '{}' as it is undefined. . So this wasn't any useful at all.
I copied the request and added ?error_trace=true to the URL and I got this stack trace below with error request body is required. I'm asking for help what is wrong with my transformation attached below?
Note that the preview looks fine in Kibana when creating the transformation.
Stack is running 8.17.5. I've not encountered issues before creating a transformation.
Stacktrace
{
"error": {
"root_cause": [
{
"type": "parse_exception",
"reason": "request body is required",
"stack_trace": """org.elasticsearch.ElasticsearchParseException: request body is required
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestRequest.requiredContent(RestRequest.java:327)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestRequest.contentParser(RestRequest.java:536)
at org.elasticsearch.transform@8.17.5/org.elasticsearch.xpack.transform.rest.action.RestPutTransformAction.prepareRequest(RestPutTransformAction.java:63)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:106)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController$1.onResponse(RestController.java:504)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController$1.onResponse(RestController.java:498)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.doHandleRequest(SecurityRestFilter.java:89)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.lambda$intercept$0(SecurityRestFilter.java:81)
at org.elasticsearch.server@8.17.5/org.elasticsearch.action.ActionListener$2.onResponse(ActionListener.java:257)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.lambda$authenticateAndAttachToContext$3(SecondaryAuthenticator.java:99)
at org.elasticsearch.server@8.17.5/org.elasticsearch.action.ActionListenerImplementations$ResponseWrappingActionListener.onResponse(ActionListenerImplementations.java:247)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.authenticate(SecondaryAuthenticator.java:109)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.authenticateAndAttachToContext(SecondaryAuthenticator.java:90)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.intercept(SecurityRestFilter.java:75)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:498)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.tryAllHandlers(RestController.java:662)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:341)
at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.dispatchRequest(AbstractHttpServerTransport.java:488)
at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.handleIncomingRequest(AbstractHttpServerTransport.java:584)
at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.incomingRequest(AbstractHttpServerTransport.java:461)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpPipeliningHandler.handlePipelinedRequest(Netty4HttpPipeliningHandler.java:169)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpPipeliningHandler.channelRead(Netty4HttpPipeliningHandler.java:148)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
at io.netty.codec@4.1.118.Final/io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:107)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpAggregator.channelRead(Netty4HttpAggregator.java:52)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
at io.netty.codec@4.1.118.Final/io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:107)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator.forwardData(Netty4HttpHeaderValidator.java:213)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator.forwardFullRequest(Netty4HttpHeaderValidator.java:156)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator$1.lambda$onResponse$0(Netty4HttpHeaderValidator.java:128)
at io.netty.common@4.1.118.Final/io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:173)
at io.netty.common@4.1.118.Final/io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:166)
at io.netty.common@4.1.118.Final/io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472)
at io.netty.transport@4.1.118.Final/io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:566)
at io.netty.common@4.1.118.Final/io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
at io.netty.common@4.1.118.Final/io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
at java.base/java.lang.Thread.run(Thread.java:1575)
"""
}
],
"type": "parse_exception",
"reason": "request body is required",
"stack_trace": """org.elasticsearch.ElasticsearchParseException: request body is required
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestRequest.requiredContent(RestRequest.java:327)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestRequest.contentParser(RestRequest.java:536)
at org.elasticsearch.transform@8.17.5/org.elasticsearch.xpack.transform.rest.action.RestPutTransformAction.prepareRequest(RestPutTransformAction.java:63)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:106)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController$1.onResponse(RestController.java:504)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController$1.onResponse(RestController.java:498)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.doHandleRequest(SecurityRestFilter.java:89)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.lambda$intercept$0(SecurityRestFilter.java:81)
at org.elasticsearch.server@8.17.5/org.elasticsearch.action.ActionListener$2.onResponse(ActionListener.java:257)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.lambda$authenticateAndAttachToContext$3(SecondaryAuthenticator.java:99)
at org.elasticsearch.server@8.17.5/org.elasticsearch.action.ActionListenerImplementations$ResponseWrappingActionListener.onResponse(ActionListenerImplementations.java:247)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.authenticate(SecondaryAuthenticator.java:109)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.authc.support.SecondaryAuthenticator.authenticateAndAttachToContext(SecondaryAuthenticator.java:90)
at org.elasticsearch.security@8.17.5/org.elasticsearch.xpack.security.rest.SecurityRestFilter.intercept(SecurityRestFilter.java:75)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:498)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.tryAllHandlers(RestController.java:662)
at org.elasticsearch.server@8.17.5/org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:341)
at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.dispatchRequest(AbstractHttpServerTransport.java:488)
at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.handleIncomingRequest(AbstractHttpServerTransport.java:584)
at org.elasticsearch.server@8.17.5/org.elasticsearch.http.AbstractHttpServerTransport.incomingRequest(AbstractHttpServerTransport.java:461)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpPipeliningHandler.handlePipelinedRequest(Netty4HttpPipeliningHandler.java:169)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpPipeliningHandler.channelRead(Netty4HttpPipeliningHandler.java:148)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:442)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
at io.netty.codec@4.1.118.Final/io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:107)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpAggregator.channelRead(Netty4HttpAggregator.java:52)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
at io.netty.codec@4.1.118.Final/io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:107)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)
at io.netty.transport@4.1.118.Final/io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator.forwardData(Netty4HttpHeaderValidator.java:213)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator.forwardFullRequest(Netty4HttpHeaderValidator.java:156)
at org.elasticsearch.transport.netty4@8.17.5/org.elasticsearch.http.netty4.Netty4HttpHeaderValidator$1.lambda$onResponse$0(Netty4HttpHeaderValidator.java:128)
at io.netty.common@4.1.118.Final/io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:173)
at io.netty.common@4.1.118.Final/io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:166)
at io.netty.common@4.1.118.Final/io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472)
at io.netty.transport@4.1.118.Final/io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:566)
at io.netty.common@4.1.118.Final/io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)
at io.netty.common@4.1.118.Final/io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
at java.base/java.lang.Thread.run(Thread.java:1575)
"""
},
"status": 400
}
Transformation
PUT _transform/syslog-hosts-log-count?error_trace=true
{
"source": {
"index": [
"logs-*"
],
"query": {
"bool": {
"filter": [
{
"bool": {
"filter": [
{
"bool": {
"should": [
{
"term": {
"tags": {
"value": "syslog"
}
}
}
],
"minimum_should_match": 1
}
},
{
"bool": {
"should": [
{
"exists": {
"field": "log.syslog.hostname"
}
}
],
"minimum_should_match": 1
}
}
]
}
}
]
}
}
},
"pivot": {
"group_by": {
"log.syslog.hostname": {
"terms": {
"field": "log.syslog.hostname"
}
},
"log.source.address": {
"terms": {
"field": "log.source.address"
}
}
},
"aggregations": {
"first_seen": {
"min": {
"field": "@timestamp"
}
},
"syslog_count": {
"value_count": {
"field": "@timestamp"
}
},
"last_seen": {
"max": {
"field": "@timestamp"
}
}
}
},
"frequency": "10m",
"dest": {
"index": "syslog-hosts-log-count"
}
}
