Kibana 7.6.2 csv download failed we couldn't generate your csv at this time.
I checked kibana.yml but there is no xpack.reporting.csv.maxSizeBytes mentioned in the settings. Also, I checked with a very small sample too which only had 2 log lines and that too failed. I am attaching kibana.yml and kibana.log for reference.
Kibana.yml:
# Kibana is served by a back end server. This setting specifies the port to use.
server.port: xxxx
# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "localhost"
server.host: "x.x.x.x"
# Enables you to specify a path to mount Kibana at if you are running behind a proxy.
# Use the server.rewriteBasePath setting to tell Kibana if it should remove the basePath
# from requests it receives, and to prevent a deprecation warning at startup.
# This setting cannot end in a slash.
server.basePath: ""
# Specifies whether Kibana should rewrite requests that are prefixed with
# server.basePath or require that they are rewritten by your reverse proxy.
# This setting was effectively always false before Kibana 6.3 and will
# default to true starting in Kibana 7.0.
server.rewriteBasePath: false
# The maximum payload size in bytes for incoming server requests.
server.maxPayloadBytes: 10485760
# The Kibana server's name. This is used for display purposes.
server.name: "your-hostname"
# The URLs of the Elasticsearch instances to use for all your queries.
elasticsearch.hosts: ["xxxxx"]
elasticsearch.hosts: ["xxxxx", "xxxxxx"]
# When this setting's value is true Kibana uses the hostname specified in the server.host
# setting. When the value of this setting is false, Kibana uses the hostname of the host
# that connects to this Kibana instance.
elasticsearch.preserveHost: true
# Kibana uses an index in Elasticsearch to store saved searches, visualizations and
# dashboards. Kibana creates a new index if the index doesn't already exist.
kibana.index: ".kibana"
kibana.index: ".kibana-6"
# The default application to load.
kibana.defaultAppId: "home"
kibana.defaultAppId: "dashboard/BaseFiltered"
kibana.defaultAppId: "dashboard/"
# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
elasticsearch.username: "xxxxx"
elasticsearch.password: "xxxx"
elasticsearch.username: "xxxxxxxxxxxxxxx"
elasticsearch.password: "xxxxxxxxxxxxxxx"
# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
# These settings enable SSL for outgoing requests from the Kibana server to the browser.
xpack.security.enabled: false
server.ssl.enabled: true
elasticsearch.ssl.verificationMode: none
server.ssl.certificate: /path/to/your/server.crt
server.ssl.key: /etc/kibana/sys.key
server.ssl.key: /path/to/your/server.key
server.ssl.certificate: /etc/kibana/sys.cer
elasticsearch.ssl.verfication: false
elasticsearch.ssl.certificateAuthorities: /etc/kibana/rootca.cer
#######SearchGaurd#######
#searchguard.basicauth.enabled:false
searchguard.session.ttl: 2147483646
searchguard.session.keepalive: true
searchguard.cookie.ttl: 0
# Optional settings that provide the paths to the PEM-format SSL certificate and key files.
# These files are used to verify the identity of Kibana to Elasticsearch and are required when
# xpack.security.http.ssl.client_authentication in Elasticsearch is set to required.
elasticsearch.ssl.certificate: /path/to/your/client.crt
elasticsearch.ssl.key: /path/to/your/client.key
# Optional setting that enables you to specify a path to the PEM file for the certificate
# authority for your Elasticsearch instance.
elasticsearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]
# To disregard the validity of SSL certificates, change this setting's value to 'none'.
elasticsearch.ssl.verificationMode: full
# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of
# the elasticsearch.requestTimeout setting.
elasticsearch.pingTimeout: 1500
# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value
# must be a positive integer.
elasticsearch.requestTimeout: 30000
# List of Kibana client-side headers to send to Elasticsearch. To send no client-side
# headers, set this value to [] (an empty list).
elasticsearch.requestHeadersWhitelist: [ authorization ]
# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten
# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.
elasticsearch.customHeaders: {}
# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.
elasticsearch.shardTimeout: 30000
# Time in milliseconds to wait for Elasticsearch at Kibana startup before retrying.
elasticsearch.startupTimeout: 5000
# Logs queries sent to Elasticsearch. Requires logging.verbose set to true.
elasticsearch.logQueries: false
# Specifies the path where Kibana creates the process ID file.
#pid.file: /var/run/kibana.pid
# Enables you specify a file where Kibana stores log output.
#logging.dest: /var/log/kibana/kibana2.log
# Set the value of this setting to true to suppress all logging output.
#logging.silent: false
# Set the value of this setting to true to suppress all logging output other than error messages.
#logging.quiet: false
# Set the value of this setting to true to log all events, including system usage information
# and all requests.
#logging.verbose: false
# Set the interval in milliseconds to sample system and process performance
# metrics. Minimum is 100ms. Defaults to 5000.
#ops.interval: 5000
# Specifies locale to be used for all localizable strings, dates and number formats.
# Supported languages are the following: English - en , by default , Chinese - zh-CN .
#i18n.locale: "en"
Kibana log:
*{"type":"log","@timestamp":"2024-04-08T14:23:46Z","tags":["reporting","csv_from_savedobject","execute-job","immediate","info"],"pid":1442,"message":"Executing job from immediate API"}
*{"type":"error","@timestamp":"2024-04-08T14:23:46Z","tags":["reporting","csv_from_savedobject","execute-job","immediate","error"],"pid":1442,"level":"error","error":{"message":"[parsing_exception] [query_string] *
*query does not support [0], with { line=1 & col=226 }","name":"Error","stack":"Error: [parsing_exception] [query_string] query does not support [0], with { line=1 & col=226 }\n at respond *
*(/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:349:15)\n at checkRespForFailure (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:306:7)\n at HttpConnector. *
*(/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:173:7)\n at IncomingMessage.wrapper (/usr/share/kibana/node_modules/elasticsearch/node_modules/lodash/lodash.js:4929:19)\n at IncomingMessage.emit *
*(events.js:203:15)\n at endReadableNT (_stream_readable.js:1145:12)\n at process._tickCallback (internal/process/next_tick.js:63:19)"},"message":"[parsing_exception] [query_string] query does not support [0], with *
{ line=1 & col=226 }"}
{"type":"log","@timestamp":"2024-04-08T14:23:46Z","tags":["reporting","csv_from_savedobject","execute-job","immediate","error"],"pid":14,"message":"Generate CSV Error! [parsing_exception] [query_string] query does not support *
[0], with { line=1 & col=226 } :: {"path":"/logstash-/_search","query":{"scroll":"30s","size":500},"body":"{\"source\":{\"includes\":[\"@timestamp\",\"EventTime\",\"Hostname\",\*
*"SyslogSeverity\",\"SourceName\",\"Message\"]},\"docvalue_fields\":[\"@timestamp\",{\"field\":\"@timestamp\",\"format\":\"date_time\"}],\"query\":{\"bool\":{\"must\":[{\*
"query_string\":{\"0\":\"{\",\"1\":\" \",\"2\":\"\\\"\",\"3\":\"a\",\"4\":\"n\",\"5\":\"a\",\"6\":\"l\",\"7\":\"y\",\"8\":\"z\",\"9\":\"e\",
*\"10\":\"\",\"11\":\"w\",\"12\":\"i\",\"13\":\"l\",\"14\":\"d\",\"15\":\"c\",\"16\":\"a\",\"17\":\"r\",\"18\":\"d\",\"19\":\"\\\"\",\"20\":
\":\",\"21\":\" \",\"22\":\"t\",\"23\":\"r\",\"24\":\"u\",\"25\":\"e\",\"26\":\" \",\"27\":\"}\",\"query\":\"\",\"analyze_wildcard\":true,\"time_zone\"*
:\"America/Toronto\"}}],\"filter\":[{\"range\":{\"@timestamp\":{\"format\":\"strict_date_time\",\"gte\":\"2024-04-07T20:00:00-04:00\",\"lte\":\"2024-04-07T20:30:00-04:00\"}}},{\"bool\"
:{\"must\":[{\"query_string\":{\"query\":\"\",\"analyze_wildcard\":true,\"time_zone\":\"America/Toronto\"}},{\"match_all\":{}}],\"filter\":[{\"match_phrase\":{\"SyslogSeverity.keyword\*
*":\"ERR\"}},{\"match_phrase\":{\"SourceName\":\"DistTransfer\"}},{\"range\":{\"@timestamp\":{\"gte\":\"2024-04-08T00:00:00.000Z\",\"lte\":\"2024-04-08T00:30:00.000Z\",\"format\":\*
"strict_date_optional_time\"}}}],\"should\":[],\"must_not\":[{\"match_phrase\":{\"SyslogSeverity\":{\"query\":\"DEBUG\"}}},{\"match_phrase\":{\"SyslogSeverity\":{\"query\":\"INFO\"}}},
*{\"match_phrase\":{\"Message\":\"is expired since\"}},{\"match_phrase\":{\"Location\":\"Alpha\"}},{\"match_phrase\":{\"Message\":\"ui_log_type=error\"}},{\"match_phrase\":{\*
*"SourceName\":\"Collector\"}},{\"match_phrase\":{\"SourceName\":\"Processing\"}},{\"match_phrase\":{\"SourceName\":\"Other\"}}]}}],\"should\":,\"must_not\":}},\"script_fields\":{},\*
*"sort\":[{\"@timestamp\":{\"order\":\"desc\",\"unmapped_type\":\"boolean\"}},{\"@timestamp\":{\"order\":\"desc\"}}]}","statusCode":400,"response":"{\"error\":{\"root_cause\":[{\*
"type\":\"parsing_exception\",\"reason\":\"[query_string] query does not support [0]\",\"line\":1,\"col\":226}],\"type\":\"parsing_exception\",\"reason\":\"[query_string] query does not support
-
[0]\",\"line\":1,\"col\":226},\"status\":400}"}"}*
-
-
-
{"type":"error","@timestamp":"2024-04-08T14:23:46Z","tags":[],"pid":144,"level":"error","error":{"message":"[parsing_exception] [query_string] query does not support [0], with { line=1 & col=226 }","name":"Error","stack":
*"Error: [parsing_exception] [query_string] query does not support [0], with { line=1 & col=226 }\n at respond (/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:349:15)\n at checkRespForFailure *
*(/usr/share/kibana/node_modules/elasticsearch/src/lib/transport.js:306:7)\n at HttpConnector. (/usr/share/kibana/node_modules/elasticsearch/src/lib/connectors/http.js:173:7)\n at IncomingMessage.wrapper *
*(/usr/share/kibana/node_modules/elasticsearch/node_modules/lodash/lodash.js:4929:19)\n at IncomingMessage.emit (events.js:203:15)\n at endReadableNT (_stream_readable.js:1145:12)\n at process._tickCallback *
(internal/process/next_tick.js:63:19)"},"url":{"protocol":null,"slashes":null,"auth":null,"host":null,"port":null,"hostname":null,"hash":null,"search":null,"query":{},"pathname":"/api/reporting/v1/generate/immediate/csv/
*saved-object/search:logstash2","path":"/api/reporting/v1/generate/immediate/csv/saved-object/search:logstash2","href":"/api/reporting/v1/generate/immediate/csv/saved-object/search:logstash2"},"message":"[parsing_exception] *
[query_string] query does not support [0], with { line=1 & col=226 }"}
{"type":"response","@timestamp":"2024-04-08T14:23:46Z","tags":["api"],"pid":1442,"method":"post","statusCode":500,"req":{"url":"/api/reporting/v1/generate/immediate/csv/saved-object/search:logstash2","method":"post","headers":
{"host":"xxxxxxx","connection":"keep-alive","content-length":"1021","sec-ch-ua":"" Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0
; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36","kbn-version":"7.6.2","content-type":"application/json","accept":"/","origin":"xxxx","sec-fetch-site":"same-origin",
"sec-fetch-mode":"cors","sec-fetch-dest":"empty","referer":"xxxxxx/","accept-encoding":"gzip, deflate, br","accept-language":"en-US,en;q=0.9"},"remoteAddress":"x.x.x.x","userAgent":"x.x.x.x",
"referer":"xxxxx"},"res":{"statusCode":500,"responseTime":214,"contentLength":9},"message":"POST /api/reporting/v1/generate/immediate/csv/saved-object/search:logstash2 500 214ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-08T14:23:46Z","tags":[],"pid":1442,"method":"get","statusCode":304,"req":{"url":"/bundles/kbn-ui-shared-deps/icon.alert-js.js","method":"get","headers":{"host":"xxxxx","connection":
"keep-alive","sec-ch-ua":"" Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"","sec-ch-ua-mobile":"?0","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) *
Chrome/ Safari/","accept":"/","sec-fetch-site":"same-origin","sec-fetch-mode":"no-cors","sec-fetch-dest":"script","referer":"xxxxx","accept-encoding":"gzip, deflate, br",*
"accept-language":"en-US,en;q=0.9","if-none-match":""fasdfasdgasge-/bundles/kbn-ui-shared-deps/-gzip""},"remoteAddress":"x.x.x.x","userAgent":"x.x.x.x","referer":"xxxxx"}
,"res":{"statusCode":304,"responseTime":4,"contentLength":9},"message":"GET /bundles/kbn-ui-shared-deps/icon.alert-js.js 304 4ms - 9.0B"}