All Products
Search

This Product

    Elasticsearch:FAQ about the Kibana console

    Document Center

    Elasticsearch:FAQ about the Kibana console

    Last Updated:May 31, 2023

    This topic provides answers to some frequently asked questions about the Kibana console.

    How do I log on to the Kibana console? What are the username and password?

    For information about how to log on to the Kibana console, see Log on to the Kibana console. The username is elastic. The password is the one you specified when you created your Elasticsearch cluster. If you forget the password, you can reset it. For more information about the procedure and precautions for resetting the password, see Reset the access password for an Elasticsearch cluster.

    What is the password of the elastic account used for?

    Note

    The elastic account is the administrator account of Elasticsearch and has full permissions to manage Elasticsearch clusters.

    You must specify the password of the elastic account for permission verification when you use one of the following items to access your Elasticsearch cluster:

    • API or SDK

    • Kibana

    Can I use the Kibana console to access Internet services such as Baidu Maps and AMAP?

    No, you cannot use the Kibana console to access Internet services. You can use the Kibana console to access only the services that are deployed in virtual private clouds (VPCs).

    How do I manage permissions in the Kibana console?

    • We recommend that you create users and assign roles to the users in the Kibana console of your Elasticsearch cluster. Then, use the users to perform operations on the cluster. For more information, see Use the RBAC mechanism provided by Elasticsearch X-Pack to implement access control.

    • We recommend that you do not use the elastic account to search for data. If the password of the elastic account is leaked, your cluster is exposed to security risks.

    • We recommend that you do not reset the password of the elastic account unless necessary. If you use the elastic account to manage your workloads, your requests are rejected due to authentication failures, and your workloads are interrupted after you reset the password.

    What do I do if the Kibana console fails to start and displays the "Kibana server is not ready yet" message?

    Possible cause

    Solution

    Multiple Kibana system indexes exist, or data structures are changed.

    Delete the indexes whose names start with .kibana, and restart your Kibana node or Elasticsearch cluster in the Elasticsearch console. For more information about how to restart a cluster or node, see Restart a cluster or node.

    Warning

    After you delete the indexes whose names start with .kibana, the spaces and patterns created in Kibana are lost. You need to use a snapshot to restore the indexes. For more information, see Restore a .kibana_{num} index.

    No indexes whose names start with .kibana exist.

    Run the GET _cluster/settings command to check whether the Auto Indexing feature limits the creation of system indexes. If the Auto Indexing feature limits the creation of system indexes, enable the system index creation feature. Otherwise, restart your Kibana node.

    Your Elasticsearch cluster is overloaded.

    Go to the Cluster Monitoring page of the cluster to troubleshoot the issue. The issue occurs due to one of the following causes. A solution is provided for each cause to help you resolve the issue.

    • The cluster uses data nodes with small specifications (one vCPU and 2 GiB of memory). In this case, we recommend that you upgrade the configuration of your cluster at the earliest opportunity. For more information, see Upgrade the configuration of a cluster. Data nodes with one vCPU and 2 GiB of memory are no longer provided for purchase.

    • The cluster stores useless indexes that occupy large memory. In this case, delete these indexes, especially monitoring indexes. Monitoring indexes are indexes whose names start with .monitor. We recommend that you specify a retention period for monitoring indexes. For more information, see Configure monitoring indexes.

    Your Kibana node is overloaded.

    If the issue persists after you perform the preceding operations, your Kibana node may be overloaded. In this case, you can restart the Kibana node or upgrade the specifications of the Kibana node in the console. For more information, see Restart a cluster or node or Upgrade the configuration of a cluster.

    Important

    Kibana nodes with 1 vCPU and 2 GiB of memory are not suitable for production environments. We recommend that you upgrade the Kibana node in your cluster at the earliest opportunity.

    What do I do if the "Maximum call stack size exceeded" error is reported when I use the Kibana console?

    • Cause

      Your cluster is in an abnormal state, and access to the Kibana console times out. This is because large heap memory is consumed and the heap memory of your cluster is insufficient.

    • Solution

      We recommend that you reduce the size of a bulk write request or upgrade the configuration of your cluster.

    An error is reported when I log on to the Kibana console, but I want to delete data from my cluster in the Kibana console. What do I do?

    You can use the related APIs to access your cluster and delete data from the cluster. For more information, see Use curl commands and API operations to manage an Alibaba Cloud Elasticsearch cluster. For example, you can call a related API to query all indexes stored in your cluster. Then, find the indexes that you want to delete in the returned result, and call a related API to delete the indexes. The following descriptions provide command examples:

    • Query all indexes stored in a cluster

      curl -u elastic:<yourEsPassword> -XGET 'http://es-cn-7pp2auqzk0023****.public.elasticsearch.aliyuncs.com:9200/_cat/indices?v'

    • Delete an index

      curl -u elastic:<yourEsPassword> -XDELETE 'http://es-cn-7pp2auqzk0023****.public.elasticsearch.aliyuncs.com:9200/<yourIndex>'

    What do I do if I fail to access the Dev Tools page in the Kibana console?

    Check whether the specifications of the Kibana node in your cluster are one vCPU and 2 GiB of memory. Kibana nodes with such specifications are unstable. These nodes are designed only for testing purposes and are not suitable for production environments. We recommend that you upgrade the Kibana node in your cluster at the earliest opportunity. For more information, see Upgrade the configuration of a cluster.

    How do I view the information of shards and indexes in the Kibana console?

    • Run the GET _nodes/stats command to view the information of indexes.通过命令查看索引和分片信息

    • On the Monitoring page, view the shards of indexes on a node, including heap memory usage.查看分片信息

    When I use the elastic account to create a user in the Kibana console, the "You do not have permission to manage users" message is displayed. What do I do?

    The following figure shows the error message that is displayed.报错截图

    We recommend that you perform the following steps to troubleshoot the issue:

    1. In the Kibana console, run the GET _license command to check whether the certificate expires.

    2. Run the GET /_cat/indices?v command to check whether multiple system indexes whose names start with .security- exist in the cluster. If multiple system indexes whose names start with .security- exist in the cluster, full data migration or synchronization may be performed. In this case, delete earlier versions of indexes whose names start with .security-.

    Can I install custom plug-ins for Kibana?

    No, you cannot install custom plug-ins for Kibana. Kibana versions earlier than V7.0 support only built-in plug-ins provided in the Kibana console. Kibana V7.0 and later do not support plug-ins.

    In which Kibana versions can I change the language of the Kibana console?

    In Kibana V6.7.0 and later, you can change the language of the Kibana console. The Kibana console supports two languages: English and Chinese. After you specify a language, the Kibana console is displayed in this language. You can change the language in the Basic Configuration section of the Kibana Configuration page. For more information, see Configure the language of the Kibana console.

    Why does the IP address that is resolved based on the internal domain name of the Kibana console for an Elasticsearch V7.16 cluster not belong to my VPC?

    To prevent the Kibana service from restarting because of HTTPS certificate replacement, the deployment architecture of the Kibana service is adjusted for Elasticsearch V7.16 clusters and specific Elasticsearch V7.10 clusters: A Layer 7 proxy is added for the Kibana service. Therefore, the IP address that is resolved based on the internal domain name of the Kibana console is the IP address of the proxy. The new deployment architecture of the Kibana service has passed the security review of the related Alibaba Cloud team, and the adjustment does not affect the security and use of the Kibana console.

    Can I change the default size of log data that is exported as a CSV file at a time from the Kibana console?

    By default, Alibaba Cloud Elasticsearch allows you to export 10,485,760 bytes (10 MB) of log data as a CSV file at a time from the Kibana console. If the size of log data that you want to export at a time exceeds the allowed size, the log data is truncated. This setting prevents performance and storage issues caused by the export of excessive data. To ensure cluster stability, you are not allowed to change the default size. If you need to export a large amount of log data, we recommend that you export the log data as multiple CSV files.

    How do I install a Kibana plug-in?

    For information about the prerequisites, precautions, and procedure for installing a Kibana plug-in, see Install a Kibana plug-in.

    Why does the timestamps used for filtering on the Discover page not match the timestamps stored in Elasticsearch documents?

    The timestamps used on the Discover page of the Kibana console are UTC timestamps by default, while the timestamps stored in Elasticsearch documents are local timestamps. Therefore, the timestamps on the Discover page may be different from the timestamps in Elasticsearch documents. Solutions:

    - For new data: On the Advanced Settings page of the Kibana console, change the value of dateFormat:tz to modify the time zone setting of the Kibana console.

    - For existing data: Call the reindex API to reindex the data and modify the timestamps of the data.