WHERE clause does not work for Kibana INDECES

[vaclav1]

Hello all,

I have tried to execute below query to return all indexed documents where type = dashboard. Idea is to grab all dashboard objects and do some visualization in canvas.

POST _xpack/sql?format=txt

{
"query": "SELECT * FROM .kibana_1 WHERE type = dashboard"
}

returns:

Failed to connect to Console's backend.
Please check the Kibana server is up and running

[matriv (Marios Trivyzas)]

{
    "query" : "SELECT * FROM \".kibana_1\" WHERE type = 'dashboard'"
}

You'd probably get:

{
    "error": {
        "root_cause": [
            {
                "type": "illegal_argument_exception",
                "reason": "Trying to retrieve too many docvalue_fields. Must be less than or equal to: [100] but was [269]. This limit can be set by changing the [index.max_docvalue_fields_search] index level setting."
            }
        ],
....

So you'd need to SELECT the fields you need instead of *.

[vaclav1]

This worked! thank you :-)))

[matriv (Marios Trivyzas)]

You're welcome!