{"id":9949,"date":"2023-04-06T21:44:23","date_gmt":"2023-04-07T02:44:23","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=9949"},"modified":"2023-04-07T12:45:36","modified_gmt":"2023-04-07T17:45:36","slug":"increasing-kibana-csv-report-max-size","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=9949","title":{"rendered":"Increasing Kibana CSV Report Max Size"},"content":{"rendered":"<p>The default size limit for CSV reports in Kibana is 10 meg. Since that\u2019s not enough for some of our users, I\u2019ve been testing increases to the <a href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/reporting-settings-kb.html\">xpack.reporting.csv.maxSizeBytes<\/a> value.<\/p>\n<p>We&#8217;re still limited by the <a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/modules-network.html#http-settings\" target=\"_blank\" rel=\"noopener\">ES http.max_content_length<\/a> value &#8212; which the documentation seems pretty confident <em>shouldn&#8217;t<\/em> be increased because the system can become unstable. Increasing the max Kibana report size to 100mb just yields a <em>different<\/em> error because ES\u00a0doesn\u2019t like it. 75 exhausted the JavaScript heap (?) \u2013 which I could get around by setting \u00a0NODE_OPTIONS=&#8211;max_old_space_size=4096 \u2026 <em>but<\/em> that just led to the server abending whenever a report was run (in fact, I had to remove the reports I <em>tried<\/em> to run from the server to get everything back into a working state). Increasing the limit to 50 meg, though, didn\u2019t do anything unreasonable in dev. So somewhere between 50 and 75 meg is our upper limit, and 50 seemed like a nice round number to me.<\/p>\n<p>Notes on resource usage \u2013 Data is held in memory as a report is created. We\u2019d see an increase in memory\/CPU usage while the report is being generated (or, I guess more accurately, a longer time during which the memory\/CPU usage is increased because if a 10 meg report takes 30 seconds to run then a 50 meg report is going to take 2.5 minutes to run \u2026 and the memory\/CPU usage is pretty much the same during the \u201ca report is running\u201d period).<\/p>\n<p>Then, though, the report is stashed in ElasticSearch for user(s) to retrieve within .reporting* indicies. And that&#8217;s where things get a little silly &#8212; architecturally, this is just another index; it ages off with a lifecycle policy if one exists. But it looks like they never created a lifecycle management policy. So you can still retrieve reports run a little over two years ago!\u00a0We will certainly want to set up a policy to clean up old reports \u2026 just have to decide how long is reasonable.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" width=\"709\" height=\"467\" class=\"wp-image-9950\" src=\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2023\/04\/word-image-9949-1.png\" srcset=\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2023\/04\/word-image-9949-1.png 709w, https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2023\/04\/word-image-9949-1-300x198.png 300w\" sizes=\"auto, (max-width: 709px) 100vw, 709px\" \/><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The default size limit for CSV reports in Kibana is 10 meg. Since that\u2019s not enough for some of our users, I\u2019ve been testing increases to the xpack.reporting.csv.maxSizeBytes value. We&#8217;re still limited by the ES http.max_content_length value &#8212; which the documentation seems pretty confident shouldn&#8217;t be increased because the system can become unstable. Increasing the &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1588],"tags":[1590,1589,1591],"class_list":["post-9949","post","type-post","status-publish","format-standard","hentry","category-elk","tag-elasticsearch","tag-elk","tag-kibana"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9949","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9949"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9949\/revisions"}],"predecessor-version":[{"id":9951,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9949\/revisions\/9951"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9949"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9949"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9949"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}