Kibana import / export module broken

Hi @pgayvallet, thanks for chipping in. My greetings to you and all the Kibana team :slight_smile:
As far as I can see at this stage, Kibana’s Hapi server is coming back with this message:

{“statusCode”:400,“error”:“Bad Request”,“message”:“Invalid multipart payload format”}

The client request looks like this instead:

POST /api/saved_objects/_import?overwrite=true HTTP/1.1
Host: localhost:5601
Connection: keep-alive
Content-Length: 475
sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"
DNT: 1
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
kbn-version: 7.12.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBulpOiG00tj1BaLU
Accept: */*
Origin: http://localhost:5601
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost:5601/app/management/kibana/objects
Accept-Encoding: gzip, deflate, br
Accept-Language: it-GB,it;q=0.9,en-GB;q=0.8,en-US;q=0.7,en;q=0.6
Cookie: rorSessionCookie=Fe26.2**2921ad09cab8ea65d278e63bc6f7a35ebcad5e39e122de61b00ab7f41e1bd353*1o0s_sRwD3JIXwfJzqouCw*qFAEWaWersH_VFCvYm9VD0V2V-jvtPHS6OVPm_ySzwPUqe5esousFbFazQh67SR7**b9f5e148728ae97451890f74cf59bea3e2d84eee7393ee2ad8185602cecb16a3*ayCfDrCtmUNpmljuClg9cCKYSGD7zGv6Fbvd2i7nAnQ; rorCookie=Fe26.2**f4f1b61759b2f3e24298627aaef60200da6765a923e42495348fec02013574fa*ee0Gd9l-ui9ud2JhLXKJ4w*LFaiWppQARgEq09mZw8e5XyKhyEQd0vhyecsy8j9rZraWVS-QNp4PiCuvKFxu4yZ**34c1c7258dd48d8e1bc28e5b9e0c182f315faf8096f18c0243f38684e78ffc2f*YxnfXcuWcsMM6HAxOXw37yl-JhQbrzHwsMVJXVZVDuI; rorCookie-SP={%22createdAtMillis%22:1624034003146%2C%22intervalMillis%22:5000}

------WebKitFormBoundaryBulpOiG00tj1BaLU
Content-Disposition: form-data; name="file"; filename="export.ndjson"
Content-Type: application/octet-stream

{"attributes":{"buildNum":39309},"coreMigrationVersion":"7.12.0","id":"7.12.0","migrationVersion":{"config":"7.12.0"},"references":[],"type":"config","updated_at":"2021-06-18T16:25:29.434Z","version":"WzEsMV0="}
{"exportedCount":1,"missingRefCount":0,"missingReferences":[]}
------WebKitFormBoundaryBulpOiG00tj1BaLU--

Hello ! I’ve done some packet capture on my pc, and I’ve seen some interesting things. I’ll reach you through private message (If my understanding is right, even a vanilla kibana may be impacted by the issue).

Pierre

1 Like

Thanks to @pchesneau the issue was found and fixed. It was completely unrelated to Kibana because this plugin uses an internal proxy (responsible of the poor handling of the multipart POST request).
So @pgayvallet you don’t have to worry :slight_smile:

2 Likes

As soon as my PR gets merged by ROR dev team, I will be able to create a pre release for you guys.

Please request a build directly to me in a private message or email if you are interested in trying it out. Otherwise, the fix will be in the next release.

Thanks Simone!

I plan this test as soon as possible and I will get back to you.

1 Like

Hi there!
I’m back from few days off :
The import is operating in the new version, however, it seems to be affected by more or less the same issue as in ES7.11.2 1.30.0 Enterprise two contexts rw/ro issue - #15 by abuising

I’ve added some comments in the thread.
Regards

hi @sscarduzio

We are facing same issue (“invalid multipart payload format”) when importing saved objects in Kibana. We are using 7.10.2 standard version of ES and Kibana. We were earlier on 1.30.0 of ROR. But even after upgrading to 1.31.0, we are continuing to get the error during import. We are using the free version of ES ROR and Kibana ROR plugin.

Thanks!

Hi guys, I have a new fix for this whole issue with HTTP errors spanning from import to dev tools problems.

I will send some builds @askids @pchesneau

1 Like

@askids try this build please. https://readonlyrest-data.s3.eu-west-1.amazonaws.com/build/1.32.0-pre3/free/readonlyrest_kbn_free-1.32.0-pre3_es7.12.1.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJEKIPNTOTIVGQ4EQ%2F20210716%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20210716T134752Z&X-Amz-Expires=604800&X-Amz-Signature=1c8f97d5a2a08e04697be65d983c51ab7dc9c124a85450bb294b22094b886c19&X-Amz-SignedHeaders=host

@sscarduzio, we are on 7.10.2. The one that you have shared is for 7.12.1. Can you please provide the build for 7.10.2.?

https://readonlyrest-data.s3.eu-west-1.amazonaws.com/build/1.32.0-pre3/free/readonlyrest_kbn_free-1.32.0-pre3_es7.10.2.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJEKIPNTOTIVGQ4EQ%2F20210716%2Feu-west-1%2Fs3%2Faws4_request&X-Amz-Date=20210716T142224Z&X-Amz-Expires=604800&X-Amz-Signature=311105debbba972043655a4eef72d2ff03c8b58ffd11bd6078c39d938f7d07af&X-Amz-SignedHeaders=host

Here you go!

After I upgraded, now Kibana fails to start. I reverted back to old version for now. I see following error logged in stderr file.

Error: listen EADDRINUSE: address already in use 127.0.0.1:11221
    at Server.setupListenHandle [as _listen2] (net.js:1280:14)
    at listenInCluster (net.js:1328:12)
    at doListen (net.js:1461:7)
    at process._tickCallback (internal/process/next_tick.js:63:19)

In stdout, I am seeing these entries.

[12:39:13:140] [info][plugins][ReadonlyREST][preElasticsearchProxy] Pre-Elasticsearch-proxy will listen on 127.0.0.1:11221
[ROR] - serve.js - intercepting config
[ROR] - serve.js - intercepting config
[12:39:27:294] [error][plugins][ReadonlyREST][lazyUtils] Caught an error in executeWithInterval { FetchError: request to https://myelastic.domain.com/.readonlyrest_kbn_sessions/_search failed, reason: read ECONNRESET
    at ClientRequest.<anonymous> (D:\Apps\PROGRA~1\kibana-7.10.2-windows-x86_64\plugins\readonlyrestkbn\node_modules\node-fetch\lib\index.js:1461:11)
    at ClientRequest.emit (events.js:198:13)
    at TLSSocket.socketErrorListener (_http_client.js:401:9)
    at TLSSocket.emit (events.js:198:13)
    at emitErrorNT (internal/streams/destroy.js:91:8)
    at emitErrorAndCloseNT (internal/streams/destroy.js:59:3)
    at process._tickCallback (internal/process/next_tick.js:63:19)
  message:
   'request to https://myelastic.domain.com/.readonlyrest_kbn_sessions/_search failed, reason: read ECONNRESET',
  type: 'system',
  errno: 'ECONNRESET',
  code: 'ECONNRESET' }
[12:39:28:109] [info][plugins][ReadonlyREST][preElasticsearchProxy] Pre-Elasticsearch-proxy will listen on 127.0.0.1:11221
[ROR] - serve.js - intercepting config
[ROR] - serve.js - intercepting config
[12:39:42:070] [error][plugins][ReadonlyREST][lazyUtils] Caught an error in executeWithInterval { FetchError: request to https://myelastic.domain.com/.readonlyrest_kbn_sessions/_search failed, reason: read ECONNRESET
    at ClientRequest.<anonymous> (D:\Apps\PROGRA~1\kibana-7.10.2-windows-x86_64\plugins\readonlyrestkbn\node_modules\node-fetch\lib\index.js:1461:11)
    at ClientRequest.emit (events.js:198:13)
    at TLSSocket.socketErrorListener (_http_client.js:401:9)
    at TLSSocket.emit (events.js:198:13)
    at emitErrorNT (internal/streams/destroy.js:91:8)
    at emitErrorAndCloseNT (internal/streams/destroy.js:59:3)
    at process._tickCallback (internal/process/next_tick.js:63:19)
  message:
   'request to https://myelastic.domain.com/.readonlyrest_kbn_sessions/_search failed, reason: read ECONNRESET',
  type: 'system',
  errno: 'ECONNRESET',
  code: 'ECONNRESET' }
[12:39:42:818] [info][plugins][ReadonlyREST][preElasticsearchProxy] Pre-Elasticsearch-proxy will listen on 127.0.0.1:11221
[ROR] - serve.js - intercepting config
[ROR] - serve.js - intercepting config

You need to unpatch and patch again, plus remove the optimize folder content (rm -rf optimize/*).
Or better, unpack a fresh kibana and redo the patch + plugin install.

We do unpatch before uninstall and patch again after new install. Those are part of our standard upgrade scripts… But dont remove optimize folder. Let me try it again after removing optimize folder.

Also, should this be standard step going forward (i.e. removing optimize folder during every upgrade)?

Yes, it should because it happened so many times that customers ask me “why do I have an old version number in the ROR menu even if I upgraded?”. This is failure to detect changed sources is due to the Kibana plugin system and we have no power over it.

If you see the docs about upgrading, I already added the step a few weeks ago.

Import issue seems to be fixed now. I did install from scratch for Kibana. BTW, when will 1.32.0 be publicly available?

1 Like

hi @sscarduzio can you please let me know when will 1.32.0 be available for download? We have items scheduled for prod promotion in another 3 weeks. So trying to get a date by when it will be available to decide, if that will give us sufficient time to complete testing.

This weekend we go out with 1.32.0

Thanks. But we are running into upgrade issue again, when tried upgrading it on additional servers. Even tried doing a fresh kibana install, even after deleting the existing .kibana* indices on those instances, we still get stuck stuck in kibana start up process and keep seeing the errors in loop.

In stderr, i see below error repeating in loop.
Error: listen EADDRINUSE: address already in use 127.0.0.1:11221
at Server.setupListenHandle [as _listen2] (net.js:1280:14)
at listenInCluster (net.js:1328:12)
at doListen (net.js:1461:7)
at process._tickCallback (internal/process/next_tick.js:63:19)

In kibana.log, I see below error repeating in loop. If I start kibana without ROR_Kibana plugin, KIbana starts up just fine. Enabling RORKBN brings it back into this looping status without starting kibana.

{"type":"log","@timestamp":"2021-07-27T08:25:49Z","tags":["info","plugins-service"],"pid":8472,"message":"Plugin \"ml\" is disabled."}
{"type":"log","@timestamp":"2021-07-27T08:25:49Z","tags":["info","plugins-service"],"pid":8472,"message":"Plugin \"watcher\" is disabled."}
{"type":"log","@timestamp":"2021-07-27T08:25:49Z","tags":["info","plugins-service"],"pid":8472,"message":"Plugin \"visTypeXy\" is disabled."}
{"type":"log","@timestamp":"2021-07-27T08:25:49Z","tags":["info","plugins-service"],"pid":8472,"message":"Plugin \"auditTrail\" is disabled."}
{"type":"log","@timestamp":"2021-07-27T08:25:49Z","tags":["info","plugins-service"],"pid":8472,"message":"Plugin \"graph\" is disabled."}
{"type":"log","@timestamp":"2021-07-27T08:25:49Z","tags":["info","plugins-service"],"pid":8472,"message":"Plugin \"security\" is disabled."}
{"type":"log","@timestamp":"2021-07-27T08:25:49Z","tags":["warning","config","deprecation"],"pid":8472,"message":"\"xpack.monitoring\" is deprecated and has been replaced by \"monitoring\""}
{"type":"log","@timestamp":"2021-07-27T08:25:49Z","tags":["warning","config","deprecation"],"pid":8472,"message":"Config key [monitoring.cluster_alerts.email_notifications.email_address] will be required for email notifications to work in 8.0.\""}
{"type":"log","@timestamp":"2021-07-27T08:25:50Z","tags":["info","plugins-system"],"pid":8472,"message":"Setting up [93] plugins: [taskManager,licensing,globalSearch,globalSearchProviders,encryptedSavedObjects,code,usageCollection,xpackLegacy,telemetryCollectionManager,telemetry,telemetryCollectionXpack,kibanaUsageCollection,securityOss,newsfeed,mapsLegacy,kibanaLegacy,translations,share,legacyExport,embeddable,uiActionsEnhanced,expressions,data,home,observability,cloud,console,consoleExtensions,apmOss,searchprofiler,painlessLab,grokdebugger,management,advancedSettings,indexPatternManagement,fileUpload,savedObjects,readonlyrestkbn,dashboard,dashboardMode,visualizations,visTypeVega,visTypeTimelion,timelion,features,upgradeAssistant,snapshotRestore,maps,licenseManagement,ingestManager,indexManagement,remoteClusters,crossClusterReplication,indexLifecycleManagement,enterpriseSearch,beatsManagement,transform,ingestPipelines,dataEnhanced,visTypeMarkdown,visTypeTable,tileMap,regionMap,inputControlVis,visualize,esUiShared,bfetch,canvas,charts,lens,visTypeVislib,visTypeMetric,visTypeTimeseries,rollup,visTypeTagcloud,discover,discoverEnhanced,savedObjectsManagement,spaces,reporting,lists,eventLog,actions,case,alerts,stackAlerts,triggersActionsUi,securitySolution,infra,monitoring,logstash,apm,uptime]"}
{"type":"log","@timestamp":"2021-07-27T08:25:50Z","tags":["info","plugins","readonlyrestkbn"],"pid":8472,"message":"Setting up ReadonlyREST plugin - build info: {\"versionString\":\"free-1.32.0_es7.10.2\",\"kibanaVersion\":\"7.10.2\",\"rorEdition\":\"free\",\"rorVersion\":\"1.32.0\",\"isProduction\":true,\"isEnterprise\":false,\"isPro\":false,\"isFree\":true,\"isBuildExpired\":false}"}
{"type":"log","@timestamp":"2021-07-27T08:25:50Z","tags":["info","plugins","reporting","config"],"pid":8472,"message":"Chromium sandbox provides an additional layer of protection, and is supported for Win32 OS. Automatically enabling Chromium sandbox."}
{"type":"log","@timestamp":"2021-07-27T08:25:50Z","tags":["info","plugins","monitoring","monitoring"],"pid":8472,"message":"config sourced from: production cluster"}
{"type":"log","@timestamp":"2021-07-27T08:25:51Z","tags":["info","savedobjects-service"],"pid":8472,"message":"Waiting until all Elasticsearch nodes are compatible with Kibana before starting saved objects migrations..."}
{"type":"log","@timestamp":"2021-07-27T08:25:51Z","tags":["warning","environment"],"pid":8472,"message":"Detected an unhandled Promise rejection.\nFetchError: request to https://myhost2.mydomain.com:11200/.readonlyrest_kbn_sessions/_search failed, reason: read ECONNRESET"}

On stdout, i see below log entries.
[04:57:07:988] [info][plugins][ReadonlyREST][preElasticsearchProxy] Pre-Elasticsearch-proxy will listen on 127.0.0.1:11221
[ROR] - serve.js - intercepting config
[ROR] - serve.js - intercepting config
[04:57:25:944] [info][plugins][ReadonlyREST][preElasticsearchProxy] Pre-Elasticsearch-proxy will listen on 127.0.0.1:11221
[04:57:25:959] [error][plugins][ReadonlyREST][lazyUtils] Caught an error in executeWithInterval { FetchError: request to https://myhost2.mydomain.com:11200/.readonlyrest_kbn_sessions/_search failed, reason: read ECONNRESET
at ClientRequest. (D:\Apps\PROGRA~1\kibana-7.10.2-windows-x86_64\plugins\readonlyrestkbn\node_modules\node-fetch\lib\index.js:1461:11)
at ClientRequest.emit (events.js:198:13)
at TLSSocket.socketErrorListener (_http_client.js:401:9)
at TLSSocket.emit (events.js:198:13)
at emitErrorNT (internal/streams/destroy.js:91:8)
at emitErrorAndCloseNT (internal/streams/destroy.js:59:3)
at process._tickCallback (internal/process/next_tick.js:63:19)
message:
‘request to https://myhost2.mydomain.com:11200/.readonlyrest_kbn_sessions/_search failed, reason: read ECONNRESET’,
type: ‘system’,
errno: ‘ECONNRESET’,
code: ‘ECONNRESET’ }
[04:57:25:964] [info][plugins][ReadonlyREST][preElasticsearchProxy] Pre-Elasticsearch-proxy will listen on 127.0.0.1:11221
[ROR] - serve.js - intercepting config
[ROR] - serve.js - intercepting config

This new ROR kibana plugin platform’s upgrade experience is pretty poor compared to older versions. Even after physically restarting the kibana server, the error “address already in use” was not addressed. Please suggest how to resolve the issue.

Man, I have never encountered this issue in quite a few happyh new platform customers now.

There must be something different here. Can we please schedule a zoom session? I’d like to take a closer look, if possible?

About the new platform: we removed 90% our code outside the ever changing Kibana plugin API, that meant we had to recreate and rewrite the functionality we previously gave for granted because Kibana offered them as a framework. I.e. ES client, SSL server and client, high availability http server and client.

This code is a couple of months young, but we are rapidly converging to stability, and the stability will accumulate, because it won’t be forced to rewrite our code every other month like we used to in the old platform due to Kibana API changes.

Have a look at the amount of fixes we fit in every release. This one will be yet another, no worries at all :slight_smile: