Unable to parse imported visualizations on version 5.2.0

Elastic Stack Kibana
1

Hey Guys,

I just installed the new Kibana and Elasticsearch (5.2.0) on my env and got some issues with my already created dashboards.
With the previous version 5.1.2 i did not get these errors.

What i try to do is create a vertical bar chart with x-axis:
hostname
severity (include pattern ERROR)
program

Each time when i add the pattern i receive following error in Kibana:

Visualize: [parsing_exception] Expected [START_OBJECT] under [size], but got a [VALUE_NUMBER] in [5], with { line=1 & col=397 }

My visualization:

{
"title":"Error logs/servers",
"type":"histogram",
"params":{
"shareYAxis":true,
"addTooltip":true,
"addLegend":true,
"legendPosition":"right",
"scale":"linear",
"mode":"stacked",
"times":[
],
"addTimeMarker":false,
"defaultYExtents":false,
"setYExtents":false,
"yAxis":{
}
},
"aggs":[
{
"id":"3",
"enabled":true,
"type":"terms",
"schema":"segment",
"params":{
"field":"hostname.keyword",
"include":{
"pattern":""
},
"size":10,
"order":"desc",
"orderBy":"2"
}
},
{
"id":"5",
"enabled":true,
"type":"terms",
"schema":"split",
"params":{
"field":"severity.keyword",
"include":{
"pattern":"ERROR"
},
"size":10,
"order":"desc",
"orderBy":"2",
"row":true
}
},
{
"id":"4",
"enabled":true,
"type":"terms",
"schema":"group",
"params":{
"field":"program.keyword",
"size":5,
"order":"desc",
"orderBy":"2"
}
},
{
"id":"2",
"enabled":true,
"type":"count",
"schema":"metric",
"params":{
}
}
],
"listeners":{
}
}

Any idea why i got this error on 5.2.0 and not on 5.1.2 and how to solve this?

Thx!

2

@jmaelbrancke are you trying to create a new vertical bar chart in 5.2.0 and it's giving you this exception; or did you create a vertical bar chart in 5.1.2, upgrade to 5.2.0 and then try to view the existing chart?

3

@Brandon_Kobel both ways give me this error.

I don't have the problem when i create the vizualization without the include pattern.

4

@jmaelbrancke would you please export the affected visualization and attach it?

5

@Brandon_Kobel i'm not able to upload the json file.
Below you can find the export.json.

[
{
"_id": "Error-logs-slash-servers",
"_type": "visualization",
"_source": {
"title": "Error logs/servers",
"visState": "{"title":"Error logs/servers","type":"histogram","params":{"shareYAxis":true,"addTooltip":true,"addLegend":true,"legendPosition":"right","scale":"linear","mode":"stacked","times":,"addTimeMarker":false,"defaultYExtents":false,"setYExtents":false,"yAxis":{}},"aggs":[{"id":"3","enabled":true,"type":"terms","schema":"segment","params":{"field":"hostname.keyword","include":{"pattern":""},"size":10,"order":"desc","orderBy":"2"}},{"id":"5","enabled":true,"type":"terms","schema":"split","params":{"field":"severity.keyword","include":{"pattern":"ERROR"},"size":10,"order":"desc","orderBy":"2","row":true}},{"id":"4","enabled":true,"type":"terms","schema":"group","params":{"field":"program.keyword","size":5,"order":"desc","orderBy":"2"}},{"id":"2","enabled":true,"type":"count","schema":"metric","params":{}}],"listeners":{}}",
"uiStateJSON": "{}",
"description": "",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{"index":"ovs-","query":{"query_string":{"analyze_wildcard":true,"query":""}},"filter":}"
}
}
}
]

6

@jmaelbrancke would you mind taking a screenshot of where you're seeing that error? I'm having trouble trying to replicate the issue that you're experiencing.

1 Like
7

@Brandon_Kobel i added both outputs from 5.2.0 (one with the include pattern and one without) and from 5.2.1.

Kibana 5.2.0 with include pattern

Kibana 5.2.0 without include pattern

Kibana 5.1.2

8

@jmaelbrancke Hi,I have same issue,and I got same error as you.

Did you find a solution?
I have to remove all Include and Exclude Pattern,This is very bad.

Here is my post:

9

Hi @Terence_Chuen,

At this moment i'm waiting for a response from @Brandon_Kobel.

Grtz

10

Apologies for the delay responding, I've had trouble replicating this behavior, but I'm checking with a few others who have more intimate knowledge of these visualizations.

11

No problem, take your time.

If you need extra information, debug logs, .... just ping me and i'll give it to you.

Grtz

12

This is being caused by a known issue with 5.2.0. Elasticsearch accidentally removed support for an "outdated" way to specify Includes/Excludes that Kibana was using, and it will be added back by Elasticsearch in 5.2.1. Here's the GitHub issue for a bit more context: https://github.com/elastic/kibana/issues/10159

13

Hi,@Brandon_Kobel .

I have two question:

  1. According to issue #10159 on github,should I downgrade to 5.1?

  2. issue #10159 suggest we should update to the new syntax,where can I found the technical documentation about new syntax?

I would like to thank you for your answer.

14

@Terence_Chuen you could potentially downgrade to 5.1 to resolve this issue, but you'd have to downgrade Kibana/ES; or 5.2.1 should be coming out shortly that will address this issue.

Here's the ES github issue where the old/new syntax is discussed: https://github.com/elastic/elasticsearch/issues/22933. KIbana is using the old syntax of "exclude":{"pattern":"apollo"} where the new syntax is simply "exclude": "apollo". You won't have to change anything in your visualization to get this new syntax to work, as Kibana is responsible for generating the query.

15

Thank you very much,I will wait for the new version.

16

Hi @Brandon_Kobel,

I installed the new 5.2.1 Elasticsearch and Kibana like you recommended but i still receive the same error:

Error Visualize: [parsing_exception] Expected [START_OBJECT] under [size], but got a [VALUE_NUMBER] in [5], with { line=1 & col=397 }

I did not change anything to my visualizations.

Elasticsearch and Kibana version:

dpkg -l | grep -E "(kibana|elasticsearch)"
ii elasticsearch 5.2.1 all Elasticsearch is a distributed RESTful search engine built for the cloud. Reference documentation can be found at Elasticsearch Guide [8.11] | Elastic and the 'Elasticsearch: The Definitive Guide' book can be found at Elasticsearch: The Definitive Guide [2.x] | Elastic
ii kibana 5.2.1 amd64 Explore and visualize your Elasticsearch data

screenshot from Kibana when i try to add the include pattern:

1920×992 71.3 KB

17

@jmaelbrancke the fix slipped from the 5.2.1 release and it's currently planed for the 5.3 release.

18

@Brandon_Kobel thank you for the update.
Any idea when 5.3 will be released?

19

@jmaelbrancke unfortunately, we don't have a release date scheduled for 5.3 yet, but it's begun internal alpha testing.

20

Tnx @Brandon_Kobel for the input!
I hope that It'll come up soon ! very useful feature :slight_smile:
Please comment here for any changes ( where will I see the official announcement for this issue?)
Tnx