Loading quick values failed with status: Bad Request

Graylog Central (peer support)
1

Hi, I have a graylog setup running past 2 years, everything working fine. but suddenly from last 2 days whenever i try to load quick values on any field i get the below two results.

i. Quick values appear but the chart is always zero and no values displayed
ii. I get the error Loading quick values failes with status: Bad Request.

I analysed the issue in developer mode i found status as error code :400
as it is 400 it seemed to be corrupted cookie/cache. I have cleared the cookies and caches but still facing the issue.

Is there any possible solution to resolve this issue.

2

Check the logs of your Graylog and Elasticsearch nodes.
:arrow_right: http://docs.graylog.org/en/2.4/pages/configuration/file_location.html

3

I could see the below log in the graylog-server logs, Recently we increased the index size to 90Millin messages/index, Could this be due to large index size?

2018-05-24T18:35:52.940+02:00 WARN [SearchResource] Unable to execute search: Failed to execute phase [query], all shards failed; shardFailures {[rntF-aNATDaTvMZpJo0lUw][graylog2_935][0]: RemoteTransportException[[LXAA0010.rwest.local][inet[/10.90.3.233:9300]][indices:data/read/search[phase/query]]]; nested: ElasticsearchException[org.elasticsearch.common.breaker.CircuitBreakingException: [FIELDDATA] Data too large, data for [className] would be larger than limit of [10058465280/9.3gb]]; nested: UncheckedExecutionException[org.elasticsearch.common.breaker.CircuitBreakingException: [FIELDDATA] Data too large, data for [className] would be larger than limit of [10058465280/9.3gb]];

4

Apologies it is 60 million messages/index.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.