Skip to content

[Blocker] KQL Autocomplete chokes ES #58749

@lizozom

Description

@lizozom

Kibana version:
7.6, 7.6.1, 8.0

Elasticsearch version:

Server OS version:

Browser version:

Browser OS version:

Original install method (e.g. download page, yum, from source, etc.):

Describe the bug:
This bug is a combination of several issues:

  1. This pr accidentally removed the timeout from the autocomplete request making the autocomplete requests run without a timeout (combination of dropping the ms suffix from timeout and fetching the config from the wrong place, resulting in an undefined timeout being sent to ES.

  2. This pr introduced query cancellation, but the query wasn't actually canceled on the server until 7.7 Abort cancelled search requests to Elasticsearch #56788

Together, these two issues cause ES to get to 100% CPU in a production environment, making it almost unusable unless KQL autocomplete is disabled.

Steps to reproduce:

  1. Run kibana in verbose mode
elasticsearch.logQueries: true 
logging.verbose: true 
  1. Type a KQL query into the query bar.
  2. Find the request sent to ES in the console. it should have had timeout and terminate_after, but it doesn't.

Expected behavior:
All requests should have timeout and terminate_after

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions