Using Kibana discover on the Marvel indices hangs

Elastic Stack Kibana
1

Hi All,

I'm trying to use Kibana's discover feature to view .marvel-1-es-* but it just seems to hang.
The indices aren't really that large compared to my main logstash indices which are around 15GB a day and work fine with discover.

Is there some reason I've overlooked as to why .marvel-1-es-* would caused Kibana to hang on the discover feature?

By hang, I mean literally no data returned just the 'searching' animation and eventually (as I'm using chrome) the page offers to kill or wait.

Update: additionally, I'm only looking at the last 15 minutes.

Many thanks,

jdmac

2

The issue is the size of some of the marvel fields. Certain browsers just can't handle rendering the values in some of the documents. The only way to make it work is setting the columns before the first request gets sent out, or using sense/console

3

Hi @spalger, thanks for your reply.

I have been using sense and raw search queries (curl) as a work around, but it'd be really useful for me to be able to make correct use of discover in Kibana.

I have also attempted multiple browsers, in relation to your comment about browsers.
Chrome, Firefox and IE seem to do the same. Eventually loads but not efficiently.

You mention setting columns before, however the difficulty I have is two parted:

  1. Education wise: I've only just started using Kibana's discover, or attempting to, and I'm not sure how I'd restrict columns in the manner you describe - Are we just talking about removing or hiding a field on the Kibana template?
  2. Technically, it hangs the moment I try to open the indices in discover. How do I identify those that are problematic values?

Any advice you can offer, I'd really appreciate.

Thanks,

jdmac

4

@spalger - I have retested using Firefox, seems actually to have more success than Chrome and IE.

Ok, longer usage on Firefox and repeated attempts on Chrome and IE seems to identify, as you rightly said, browsers being incapable of dealing with the data. Chrome and IE seem to crash pretty much every time. Firefox is repeatedly giving positive results now.

5

Glad to hear that you've found a way to get it working. This isn't usually a problem, but the marvel index has some absolutely massive fields in it, and the way that discover renders rows really isn't optimized to handle massive field values.

To add/remove columns just hover over the field in the left hand column and click the little "add" button. That will cause the table to only render that field, and then you should be able to iterate/search around/explore a lot faster.