Hello,
We’re encountering an issue with RoR and Kibana at the moment, we’re not sure why, but it seems a header is missing during an API call to kibana with RoR when trying to download a report.
Error message:
Oct 20 15:40:27 ** **-**[590046]: [2025-10-20T13:40:27.136+00:00][#033[32mDEBUG#033[39m][#033[35melasticsearch.query.data#033[39m] [TypeError]: Invalid value "undefined" for header "x-ror-kibana-index"#015
Oct 20 15:40:27 *** **[590046]: [2025-10-20T13:40:27.136+00:00][#033[31mERROR#033[39m][#033[35mhttp#033[39m] 500 Server Error#015
Oct 20 15:40:27 *** **[590046]: [2025-10-20T13:40:27.137+00:00][#033[32mDEBUG#033[39m][#033[35mplugins.licensing#033[39m] Requesting Elasticsearch licensing API#015
Oct 20 15:40:27 *** **[590046]: [2025-10-20T13:40:27.144+00:00][#033[32mDEBUG#033[39m][#033[35melasticsearch.query.data#033[39m] 200 - 1.4KB#015
Oct 20 15:40:27 *** **[590046]: GET /_xpack#015
Oct 20 15:40:27 *** **[590046]: [2025-10-20T13:40:27.146+00:00][#033[32mDEBUG#033[39m][#033[35mhttp.server.response#033[39m] GET /api/reporting/jobs/download/7a78b049-1a82-4896-9fa3-d39fe49a217a?elasticInternalOrigin=true 500 14ms - 135.0B#015
Oct 20 15:40:27 *** **[590046]: [2025-10-20T13:40:27.147+00:00][info][plugins][ReadonlyREST][proxyBuilder][x-ror-correlation-id=57a06ff8-edc5-4813-a239-5d904a6a8e39] Receiving 500 error from Kibana response with a data: {"statusCode":500,"error":"Internal Server Error","message":"An internal server error occurred. Check Kibana server logs for details."}, from url: /api/reporting/jobs/download/7a78b049-1a82-4896-9fa3-d39fe49a217a?elasticInternalOrigin=true and requested from address: undefined#015
Manually adding it in CLI doesn’t work. With a user different than the kibana user
curl -s -u ** -H "kbn-xsrf: true" -X GET "http://**:5601/api/reporting/jobs/download/7a78b049-1a82-4896-9fa3-d39fe49a217a?elasticInternalOrigin=true" -H 'x-ror-kibana-index: .kibana' -I
Enter host password for user '**':
HTTP/1.1 500 Internal Server Error
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()
cross-origin-opener-policy: same-origin
content-security-policy: script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'
content-security-policy-report-only: form-action 'report-sample' 'self'; object-src 'report-sample' 'none'
kbn-name: **
kbn-license-sig: **
content-type: application/json; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate
Content-Length: 135
date: Mon, 20 Oct 2025 13:52:24 GMT
connection: keep-alive
keep-alive: timeout=120
ETag: W/"87-gRVagrTLcYftKS2Ye3KLlaHy+LU"
Elastic stack version : 9.1.3 (issue seems to be spread across multiple version
Current config :
cat package.json
{
"name": "readonlyrestkbn",
"version": "1.66.1",
"ror_version": "1.66.1_es9.1.3",
"ror_build_time": "Wed, 03 Sep 2025 10:33:53 GMT",
"environment": "PRODUCTION",
"license": "Beshu Limited, All rights reserved",
"private": true,
"description": "ReadonlyREST security plugin for Elasticsearch and Kibana",
"main": "index.js",
"kibana": {
"version": "9.1.3"
},
kibana.yml
elasticsearch.hosts: [...]
xpack.monitoring.kibana.collection.enabled: true
xpack.monitoring.ui.enabled: true
elasticsearch.username: kibana
elasticsearch.password: '...'
server.host: 0.0.0.0
xpack.encryptedSavedObjects.encryptionKey: '...'
xpack.reporting.encryptionKey: '...'
readonlyrest_kbn.cookiePass: "..."
readonlyrest_kbn.store_sessions_in_index: true
telemetry.enabled: false
server.publicBaseUrl
readonlyrest.yml
- name: "::KIBANA-SRV::"
auth_key_sha256: //
verbosity: error # don't log successful request
indices: [".kibana*", ".reporting-*", ".ds-.kibana-reporting-*", ".kibana-reporting-*", "*"]
Request is accepted in the elasticsearch logs with RoR.
The ds exists, the _doc is indexed
GET .ds-.kibana-reporting-.kibana-2025.10.20-000002/_search
"hits": [
{
"_index": ".ds-.kibana-reporting-.kibana-2025.10.20-000002",
"_id": "7a78b049-1a82-4896-9fa3-d39fe49a217a",
"_score": 1,
"_source": {
"migration_version": "7.14.0",
"jobtype": "csv_searchsource",
"created_at": "2025-10-20T12:39:02.228Z",
"created_by": false,
"payload": {
"pagingStrategy": "pit",
"browserTimezone": "",
"columns": [],
"objectType": "search",
"searchSource": {
"fields": [
{
"field": "*",
"include_unmapped": true
}
],
"filter": [
{
"meta": {
"field": "@timestamp",
"index": "35acd23b-0bd0-4cbb-9ee9-ce0c666eee8f",
"params": {}
},
"query": {
"range": {
"@timestamp": {
"format": "strict_date_optional_time",
"gte": "2025-10-05T12:38:59.332Z",
"lte": "2025-10-20T12:38:59.332Z"
}
}
}
}
],
"index": "35acd23b-0bd0-4cbb-9ee9-ce0c666eee8f",
"query": {
"language": "kuery",
"query": ""
},
"sort": [
{
"@timestamp": {
"format": "strict_date_optional_time",
"order": "desc"
}
}
]
},
"title": "Untitled Discover session",
"version": "9.1.3",
"headers": "",
"kibanaIndex": ".kibana"
},
"meta": {
"objectType": "search"
},
"status": "completed",
"attempts": 1,
"process_expiration": "2025-10-20T12:43:04.789Z",
"space_id": "default",
"output": {
"content": "Correctly Formatted base64",
"content_type": "text/csv",
"size": 2703,
"csv_contains_formulas": true,
"max_size_reached": false
},
"@timestamp": "1970-01-01T00:00:00.000Z",
"x-ror-kibana-index": ".kibana",
"kibana_id": "d21c7f12-b0d9-479b-aaa7-4659e0166e3e",
"kibana_name": "wplgsp118d",
"max_attempts": 3,
"started_at": "2025-10-20T12:39:04.789Z",
"timeout": 240000,
"completed_at": "2025-10-20T12:39:06.232Z",
"metrics": {
"csv": {
"rows": 4
}
}
}
},
Steps to reproduce
On kibana : Discover → Export → Generate CSV. Then follow link to go to Stack management/Reporting and try downloading the generated report.
Like I said, I also encounter this issue on a 8.15.0 elastic stack. I’m not sure if the issue is me, RoR or the elastic stack. Anyone encountered the issue ?