WHERE clause does not work for Kibana INDECES

Hello all,

I have tried to execute below query to return all indexed documents where type = dashboard. Idea is to grab all dashboard objects and do some visualization in canvas.

POST _xpack/sql?format=txt

"query": "SELECT * FROM .kibana_1 WHERE type = dashboard"


Failed to connect to Console's backend.
Please check the Kibana server is up and running

    "query" : "SELECT * FROM \".kibana_1\" WHERE type = 'dashboard'"

You'd probably get:

    "error": {
        "root_cause": [
                "type": "illegal_argument_exception",
                "reason": "Trying to retrieve too many docvalue_fields. Must be less than or equal to: [100] but was [269]. This limit can be set by changing the [index.max_docvalue_fields_search] index level setting."

So you'd need to SELECT the fields you need instead of *.

1 Like

This worked! thank you :-)))

You're welcome!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.