Trace an Elasticsearch query in Kibana

ECH ECK ECE Self-Managed

Sometimes the Elasticsearch server might be slowed down by the execution of an expensive query. Such queries are logged to Elasticsearch's search slow log file. But there is a problem: it’s impossible to say what triggered a slow search request—a Kibana instance or a user accessing an Elasticsearch endpoint directly. To simplify the investigation of such cases, the search slow log file includes the x-opaque-id header, which might provide additional information about a request if it originated from Kibana.

For example, if a request to Elasticsearch was initiated by a Vega visualization on a dashboard, you will see the following in the slow logs:

 "source": { "id": "c89d1ab3-b4a7-4920-a64a-22a910a413b0;kibana:application:dashboard:edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b;visualization:Vega:cb099a20-ea66-11eb-9425-113343a037e3" } 

Take a closer look at the format of the string. The id value starts with c89d1ab3-b4a7-4920-a64a-22a910a413b0, which is a unique identifier of a request set by the Kibana server. The part after the kibana prefix indicates that the request was triggered by Dashboard with id edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b and Vega visualization with id cb099a20-ea66-11eb-9425-113343a037e3.

If the provided information is not enough to identify a visualization to adjust its parameters, you can configure Kibana logs to provide a human-readable description and a link to a source of the request:

 logging: loggers: - name: execution_context level: debug appenders: [console] 

Now, you can see the request to Elasticsearch has been initiated by the [Logs] Unique Visitor Heatmap visualization embedded in the [Logs] Web Traffic dashboard. You can navigate to the provided URL to change some parameters of the visualization.

 [DEBUG][execution_context] stored the execution context: { "type": "application", "name": "dashboard", "id": "edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b", "description": "[Logs] Web Traffic","url":"/view/edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b" "child": { "type": "visualization", "name": "Vega", "id": "cb099a20-ea66-11eb-9425-113343a037e3", "description": "[Logs] Unique Visitor Heatmap", "url": "/app/visualize#/edit/cb099a20-ea66-11eb-9425-113343a037e3" }, }