Failed to create query - field expansion matches too many fields error on Kibana for metricbeats dashboard #15863
Comments
bhavyarm
added
Feature:Dashboard
bhavyarm
added
bug
|
Old existing bug. Just keeping this here for Kibana reference:elastic/beats#5275 |
|
@simianhacker suggests setting the default field of index query to something like : |
|
I'm getting this on discover as well, the problem is kibana is setting the See https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html {
"_source": {
"excludes": []
},
"aggs": {
"2": {
"date_histogram": {
"field": "@timestamp",
"interval": "30s",
"min_doc_count": 1,
"time_zone": "America/Phoenix"
}
}
},
"docvalue_fields": [
"@timestamp",
"ceph.monitor_health.last_updated",
"docker.container.created",
"docker.healthcheck.event.end_date",
"docker.healthcheck.event.start_date",
"docker.image.created",
"kubernetes.container.start_time",
"kubernetes.event.metadata.timestamp.created",
"kubernetes.event.metadata.timestamp.deleted",
"kubernetes.node.start_time",
"kubernetes.pod.start_time",
"kubernetes.system.start_time",
"mongodb.status.background_flushing.last_finished",
"mongodb.status.local_time",
"postgresql.activity.backend_start",
"postgresql.activity.query_start",
"postgresql.activity.state_change",
"postgresql.activity.transaction_start",
"postgresql.bgwriter.stats_reset",
"postgresql.database.stats_reset",
"system.process.cpu.start_time"
],
"highlight": {
"fields": {
"*": {}
},
"fragment_size": 2147483647,
"post_tags": [
"@/kibana-highlighted-field@"
],
"pre_tags": [
"@kibana-highlighted-field@"
]
},
"query": {
"bool": {
"filter": [],
"must": [
{
"query_string": {
"analyze_wildcard": true,
"default_field": "*",
"query": "metricset.name:node"
}
},
{
"range": {
"@timestamp": {
"format": "epoch_millis",
"gte": 1516405485930,
"lte": 1516406385930
}
}
}
],
"must_not": [],
"should": []
}
},
"script_fields": {},
"size": 500,
"sort": [
{
"@timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}
],
"stored_fields": [
"*"
],
"version": true
} |
|
@simianhacker Users should be able to fix this themselves by removing |
|
Ok, so I confirmed with the ES team that |
|
can this be considered a dupe of #16232? |
|
I'd leave them both open, this describes the bug, the issue I created describes my proposed solution. If for some reason we decided we needed a different solution and closed that other ticket, I'd still want to have this issue open. |
Kibana version: 7.0.0-alpha1 snapshot
Elasticsearch version: 7.0.0-alpha1 snapshot
Server OS version: darwin_x86_64
Browser version: chrome latest
Browser OS version: OS X
Original install method (e.g. download page, yum, from source, etc.): from staging
Description of the problem including expected versus actual behavior: When I try to open a metricbeat system overview dashboard with the timepicker set to 7 days and above - Kibana errors out with
field expansion matches too many fields, limit: 1024, got: 1174"}}}]},"status":400}. Please note - Last 15 minutes, Last 30 minutes, Last 1 hour, Last 4 hours, Last 12 hours, Last 24 hours in timepicker doesn't make Kibana go coucou.Steps to reproduce:
Errors in browser console (if relevant):
Provide logs and/or server output (if relevant):
ES logs:
The text was updated successfully, but these errors were encountered: