Unable to download reports from kibana

Hello,

We’re encountering an issue with RoR and Kibana at the moment, we’re not sure why, but it seems a header is missing during an API call to kibana with RoR when trying to download a report.

Error message:

Oct 20 15:40:27 ** **-**[590046]: [2025-10-20T13:40:27.136+00:00][#033[32mDEBUG#033[39m][#033[35melasticsearch.query.data#033[39m] [TypeError]: Invalid value "undefined" for header "x-ror-kibana-index"#015
Oct 20 15:40:27 *** **[590046]: [2025-10-20T13:40:27.136+00:00][#033[31mERROR#033[39m][#033[35mhttp#033[39m] 500 Server Error#015
Oct 20 15:40:27 *** **[590046]: [2025-10-20T13:40:27.137+00:00][#033[32mDEBUG#033[39m][#033[35mplugins.licensing#033[39m] Requesting Elasticsearch licensing API#015
Oct 20 15:40:27 *** **[590046]: [2025-10-20T13:40:27.144+00:00][#033[32mDEBUG#033[39m][#033[35melasticsearch.query.data#033[39m] 200 - 1.4KB#015
Oct 20 15:40:27 *** **[590046]: GET /_xpack#015
Oct 20 15:40:27 *** **[590046]: [2025-10-20T13:40:27.146+00:00][#033[32mDEBUG#033[39m][#033[35mhttp.server.response#033[39m] GET /api/reporting/jobs/download/7a78b049-1a82-4896-9fa3-d39fe49a217a?elasticInternalOrigin=true 500 14ms - 135.0B#015
Oct 20 15:40:27 *** **[590046]: [2025-10-20T13:40:27.147+00:00][info][plugins][ReadonlyREST][proxyBuilder][x-ror-correlation-id=57a06ff8-edc5-4813-a239-5d904a6a8e39] Receiving 500 error from Kibana response with a data: {"statusCode":500,"error":"Internal Server Error","message":"An internal server error occurred. Check Kibana server logs for details."}, from url: /api/reporting/jobs/download/7a78b049-1a82-4896-9fa3-d39fe49a217a?elasticInternalOrigin=true and requested from address: undefined#015

Manually adding it in CLI doesn’t work. With a user different than the kibana user

curl -s -u ** -H "kbn-xsrf: true" -X GET "http://**:5601/api/reporting/jobs/download/7a78b049-1a82-4896-9fa3-d39fe49a217a?elasticInternalOrigin=true" -H 'x-ror-kibana-index: .kibana' -I
Enter host password for user '**':
HTTP/1.1 500 Internal Server Error
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()
cross-origin-opener-policy: same-origin
content-security-policy: script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'
content-security-policy-report-only: form-action 'report-sample' 'self'; object-src 'report-sample' 'none'
kbn-name: **
kbn-license-sig: **
content-type: application/json; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate
Content-Length: 135
date: Mon, 20 Oct 2025 13:52:24 GMT
connection: keep-alive
keep-alive: timeout=120
ETag: W/"87-gRVagrTLcYftKS2Ye3KLlaHy+LU"

Elastic stack version : 9.1.3 (issue seems to be spread across multiple version
Current config :

cat package.json
{
  "name": "readonlyrestkbn",
  "version": "1.66.1",
  "ror_version": "1.66.1_es9.1.3",
  "ror_build_time": "Wed, 03 Sep 2025 10:33:53 GMT",
  "environment": "PRODUCTION",
  "license": "Beshu Limited, All rights reserved",
  "private": true,
  "description": "ReadonlyREST security plugin for Elasticsearch and Kibana",
  "main": "index.js",
  "kibana": {
    "version": "9.1.3"
  },

kibana.yml

elasticsearch.hosts: [...]
xpack.monitoring.kibana.collection.enabled: true
xpack.monitoring.ui.enabled: true
elasticsearch.username: kibana
elasticsearch.password: '...'
server.host: 0.0.0.0
xpack.encryptedSavedObjects.encryptionKey: '...'
xpack.reporting.encryptionKey: '...'

readonlyrest_kbn.cookiePass: "..."
readonlyrest_kbn.store_sessions_in_index: true

telemetry.enabled: false
server.publicBaseUrl

readonlyrest.yml

  - name: "::KIBANA-SRV::"
    auth_key_sha256: //
    verbosity: error # don't log successful request
    indices: [".kibana*", ".reporting-*", ".ds-.kibana-reporting-*", ".kibana-reporting-*", "*"]

Request is accepted in the elasticsearch logs with RoR.

The ds exists, the _doc is indexed

GET .ds-.kibana-reporting-.kibana-2025.10.20-000002/_search
"hits": [
      {
        "_index": ".ds-.kibana-reporting-.kibana-2025.10.20-000002",
        "_id": "7a78b049-1a82-4896-9fa3-d39fe49a217a",
        "_score": 1,
        "_source": {
          "migration_version": "7.14.0",
          "jobtype": "csv_searchsource",
          "created_at": "2025-10-20T12:39:02.228Z",
          "created_by": false,
          "payload": {
            "pagingStrategy": "pit",
            "browserTimezone": "",
            "columns": [],
            "objectType": "search",
            "searchSource": {
              "fields": [
                {
                  "field": "*",
                  "include_unmapped": true
                }
              ],
              "filter": [
                {
                  "meta": {
                    "field": "@timestamp",
                    "index": "35acd23b-0bd0-4cbb-9ee9-ce0c666eee8f",
                    "params": {}
                  },
                  "query": {
                    "range": {
                      "@timestamp": {
                        "format": "strict_date_optional_time",
                        "gte": "2025-10-05T12:38:59.332Z",
                        "lte": "2025-10-20T12:38:59.332Z"
                      }
                    }
                  }
                }
              ],
              "index": "35acd23b-0bd0-4cbb-9ee9-ce0c666eee8f",
              "query": {
                "language": "kuery",
                "query": ""
              },
              "sort": [
                {
                  "@timestamp": {
                    "format": "strict_date_optional_time",
                    "order": "desc"
                  }
                }
              ]
            },
            "title": "Untitled Discover session",
            "version": "9.1.3",
            "headers": "",
            "kibanaIndex": ".kibana"
          },
          "meta": {
            "objectType": "search"
          },
          "status": "completed",
          "attempts": 1,
          "process_expiration": "2025-10-20T12:43:04.789Z",
          "space_id": "default",
          "output": {
            "content": "Correctly Formatted base64",
            "content_type": "text/csv",
            "size": 2703,
            "csv_contains_formulas": true,
            "max_size_reached": false
          },
          "@timestamp": "1970-01-01T00:00:00.000Z",
          "x-ror-kibana-index": ".kibana",
          "kibana_id": "d21c7f12-b0d9-479b-aaa7-4659e0166e3e",
          "kibana_name": "wplgsp118d",
          "max_attempts": 3,
          "started_at": "2025-10-20T12:39:04.789Z",
          "timeout": 240000,
          "completed_at": "2025-10-20T12:39:06.232Z",
          "metrics": {
            "csv": {
              "rows": 4
            }
          }
        }
      },

Steps to reproduce

On kibana : Discover → Export → Generate CSV. Then follow link to go to Stack management/Reporting and try downloading the generated report.

Like I said, I also encounter this issue on a 8.15.0 elastic stack. I’m not sure if the issue is me, RoR or the elastic stack. Anyone encountered the issue ?

Hello @nafasim

I confirm that the ELK 9.1.x version is affected by the issue. I wasn’t able to reproduce it in 8.15.0. It’s a problem on the plugin side. I will work on a fix and send you a re-release build.

1 Like

This is fixed in ROR 1.67.1

1 Like