Kibana known issues

Applies to: Elastic Stack 9.0.2

Details

Upgrading Kibana from version 8.18.x to 9.0.2 fails due to a configuration conflict if xpack.alerting.cancelAlertsOnRuleTimeout is set to false in the kibana.yml file. Kibana fails to boot and shows a fatal error message in the Kibana logs that's similar to the following:

		FATAL Error: Rule type "transform_health" cannot have both cancelAlertsOnRuleTimeout set to false and autoRecoverAlerts set to true.

	

This failure occurs when the xpack.alerting.cancelAlertsOnRuleTimeout setting is set to false, which is incompatible with the default configuration of an internal setting (autoRecoverAlerts) in 9.0.2.

Action

To temporarily resolve the issue and allow the upgrade to proceed, follow these steps:

Remove the xpack.alerting.cancelAlertsOnRuleTimeout: false setting from the kibana.yml file.
Restart Kibana to apply the changes.

Applies to: Elastic Stack 9.0.0

Details

The semantic text migration can cause excessive traffic to a cluster and might eventually cause the Kibana instance to crash due to OOM, together with increase of requests to Elasticsearch & ML nodes.

The problem can occur when there is one or more empty text Knowledge Base documents.

The migration script does not handle this scenario and will indefinitely update the same document.

Because the document update involves semantic_text an ML node is kept warm further increasing the costs.

The issue involves semantic_text field type (and thus the semantic_text migration which is causing this issue), introduced in the knowledge base feature in 8.17.

Workaround

Pause the Kibana instance if possible. If not possible, skip this step.

Run a dry run query to identify if you have empty Knowledge Base documents. If you have at least 1 hit, you can be affected by the problem.

		GET .kibana-observability-ai-assistant-kb/_search
{
  "query": {
    "bool": {
      "must": [{ "exists": { "field": "text" }}],
      "must_not": [ { "wildcard": { "text": "*" } }
      ]
    }
  }
}

	

Execute the deletion. For extra safety, you might want to trigger a snapshot before executing it.

		POST .kibana-observability-ai-assistant-kb/_delete_by_query
{
  "query": {
    "bool": {
      "must": [{ "exists": { "field": "text" }}],
      "must_not": [ { "wildcard": { "text": "*" } }
      ]
    }
  }
}

	

For more information, check: