Hello, running on:
ES-6.8.11
RoR 1.25.0
Kibana 6.8.11
readonlyrest_kbn_enterprise-1.25.0_es6.8.11
I have found that autocomplete in kibana when using a “keyword” field only works on index patterns that do not match any closed indexes. For any index patterns that resolve to open and closed indexes a code 400 Bad request is sent back from kibana.
Digging into this further it seems in 6.0 Breaking changes it is mentioned:
IndexClosedException to return 400 status code
An IndexClosedException is returned whenever an api that doesn’t support closed indices (e.g. search) is called passing closed indices as parameters and ignore_unavailable is set to false. The response status code returned in such case changed from 403 to 400
To debug this I performed a packet capture of the traffic being sent from kibana into the ES search co-ordinator Below is an excerpt from an affected request:
POST /techno*/_search
<Headers ....>
content-type: application/json
Host: 192.168.168.1:9200
Content-Length: 203
Connection: keep-alive
{"size":0,"timeout":"1s","terminate_after":100000,"query":{"bool":{"filter":[]}},"aggs":{"suggestions":{"terms":{"field":"application.keyword","include":"htt.*","execution_hint":"map","shard_size":10}}}}
The response comes back as:
HTTP/1.1 400 Bad Request
content-type: application/json; charset=UTF-8
content-length: 291
{"error":{"root_cause":[{"type":"index_closed_exception","reason":"closed","index_uuid":"wCAdA5v2Q5esupWJ0sryhQ","index":"techno-2020.10.28"}],"type":"index_closed_exception","reason":"closed","index_uuid":"wCAdA5v2Q5esupWJ0sryhQ","index":"techno-2020.10.28"},"status":400}
For this to work the request needs to be sent with “?ignore_unavailable=true” option in the URL or the relevant option set in the request body.
POST /techno*/_search?ignore_unavailable=true
Returns:
{"took":716,"timed_out":false,"terminated_early":true,"num_reduce_phases":2,"_shards":{"total":900,"successful":900,"skipped":0,"failed":0},"hits":{"total":86196770,"max_score":0.0,"hits":[]},"aggregations":{"suggestions":{"doc_count_error_upper_bound":0,"sum_other_doc_count":0,"buckets":[{"key":"http_proxy","doc_count":609},{"key":"http_video","doc_count":411},{"key":"http_audio","doc_count":188}]}}}
Again this works fine if your using an index pattern that does not involve any closed indexes. Worth noting is that previously we were using ES:6.5.4 and readonlyrest_kbn_enterprise-1.16.33_es6.5.4.zip and this was not an issue.
Thanks in advance for what I presume is an easy fix…