ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

OI Kibana searches gives errors or timeouts.

book

Article ID: 186972

calendar_today

Updated On:

Products

DX Operational Intelligence

Issue/Introduction

ELK Issue with some search terms for any time range - 


http://xxx:5601/app/kibana#/discover?_g=(refreshInterval:(display:Off,pause:!f,value:0),time:(from:now-7d,mode:quick,to:now))&_a=(columns:!(_source),index:d1ad9790-94bb-11e8-85c0-d98c57cd80e4,interval:auto,query:(language:lucene,query:'*deptAndGL'),sort:!(timestamp,desc))

error - 

No results found 

Unfortunately Services could not find any results matching the customer search.

Customer is using an index with a date field. It is possible that their query does not match anything in the current time range, or that there is no data at all in the currently selected time range. Click the button below to open the time picker. For future reference, open the time picker by clicking on the button in the top right corner of the screen.

Refine the query

The search bar at the top uses Elasticsearch's support for Lucene Query String syntax. Let's say we're searching web server logs that have been parsed into a few fields.

Environment

Release : 1.2.1

Component : CA DOI AO PLATFORM COMPONENTS

Resolution

- Highlighting raw_message. This highlights the entire message. So this why the shard access failed. This needs to be switched to raw_message_new. But that would be a future product change.
- Increased highlight.max_analyzed_offset from 100000 to 700000.
- Disabled highlighting
- Changed request timeout from 3000 to 90000
- Changed index to use replica index.