search

robcowart / elastiflow

Network flow analytics (Netflow, sFlow and IPFIX) with the Elastic Stack
Other
2.49k stars 598 forks source link

Invalid request payload JSON format #712

Closed dthpulse closed 3 years ago

dthpulse commented 3 years ago

following https://github.com/robcowart/elastiflow/issues/75#issuecomment-385724421 to deploy Elastiflow getting this error while importing json:

# curl -X POST http://localhost:5601/api/saved_objects/index-pattern/elastiflow-* -H "Content-Type: application/json" -H "kbn-xsrf: true" -d @elastiflow-4.0.1/kibana/elastiflow.kibana.7.8.x.ndjson
{"statusCode":400,"error":"Bad Request","message":"Invalid request payload JSON format"}

elastic version I'm running is 7.9.1 logstash 7.9.0

any hint on this, please?

robcowart commented 3 years ago

Why are you trying to run that command?

https://github.com/robcowart/elastiflow/blob/master/INSTALL.md#setting-up-kibana

dthpulse commented 3 years ago

When trying to import via webui in Kibana, getting:

"The file could not be processed".

robcowart commented 3 years ago

First, did you read the KNOWN_ISSUES.md file? Specifically... https://github.com/robcowart/elastiflow/blob/master/KNOWN_ISSUES.md#3-reverse-proxy-or-small-kibana-max-payload-size-can-prevent-kibana-dashboard-import

Next, if you are importing via curl, the command would be something like...

curl -XPOST "http://localhost:5601/api/saved_objects/_import?overwrite=true" -H "kbn-xsrf: true" --form file=@elastiflow.kibana.7.8.x.ndjson

Finally, it sounds like you are setting up ElastiFlow for the first time. I was curious if there is any specific reason why you decided to install this legacy version of the solution rather than the new solution?

dthpulse commented 3 years ago

nginx settings are fine on the server:

nginx.conf:  proxy_read_timeout      5m;
sites-available/kibana.conf:    proxy_read_timeout      5m;
sites-available/elasticsearch.conf:    proxy_read_timeout      5m;
sites-available/elasticsearch_logstash.conf:    proxy_read_timeout      5m;
nginx.conf:  client_max_body_size    20m;

Hmmm, looks like I missed this is legacy solution. OK , going to try new one. Will keep you posted if I will met with same issue there. Thanks!