Skip to content

Requirements and Limitations

Kibana Gateway is designed for analytical text queries, in domains like observability or security. It does literal, case-insensitive matches.

It doesn't perform

  • Tokenization: breaking strings into individual words or meaningful units
  • Natural language processing: It doesn't understand synonyms, context, and meaning
  • Scoring: There is no ranking performed based on how well a query result matches

Supported example: Searching for logs containing InvalidPassword should also match InvalidPasswordError without * as required in Elastic. Unsupported example: You need top 10 results for a query containing the string car and expect results to include entries containing string automobile.

Software and hardware requirements⚓︎

Recommended settings for each Kibana Gateway container are:

  • A minimum of two CPU cores
  • A minimum of 2 GB of RAM

Kibana Gateway is compatible with the following software versions:

Software Version
Elasticsearch/Kibana 8.0 or later

List of supported Kibana features⚓︎

Kibana Gateway allows querying data from Kibana, but not all features are supported.

You can use:

Functional limitations⚓︎

Supported⚓︎

  • Front-end support for Kibana limited to the Discover interface and Dashboard panels
  • Read-only support: Kibana Gateway queries an existing Elasticsearch cluster and Hydrolix, but doesn't write or ingest data into either

  • Most popular Query DSL, including:

    • boolean
    • match
    • match phrase
    • multi-match
    • query string
    • nested
    • match all
    • exists
    • prefix
    • range
    • term
    • terms
    • wildcard

  • Most but not all Aggregations, including:

    • avg
    • cardinality
    • max
    • min
    • percentile_ranks
    • percentiles
    • stats
    • sum
    • top_hits
    • top_metrics
    • value_count
    • date_histogram
    • date_range
    • filter
    • filters
    • histogram
    • range
    • significant_terms
    • terms
    • ip_prefix
    • ip_range
    • geo_bounds
    • geohash_grid

  • Elasticsearch schema types:

    • date
    • text
    • keyword
    • boolean
    • byte
    • short
    • integer
    • long
    • unsigned_long
    • float
    • half_float
    • double
    • ip
    • geo_point
    • point

  • ClickHouse schema types:

    • Date
    • DateTime
    • DateTime64
    • String
    • FixedString
    • LowCardinality(String)
    • Bool
    • UInt8
    • UInt16
    • UInt32
    • UInt64
    • Int8
    • Int16
    • Int32
    • Int64
    • Float32
    • Float64
    • Array

Run Kibana queries and dashboards on data stored in Hydrolix.

Unsupported⚓︎

  • Kibana Gateway doesn't allow a single query to span multiple storage types.
    • For Kibana users, this means a Data View can't combine indices backed by Elasticsearch with indices backed by Hydrolix.
    • For Elasticsearch API users, this means Kibana Gateway doesn't support queries like GET /data_a,data_b/_search where data_a is an index in Elasticsearch and data_b is a table in Hydrolix.
    • A single query can't span multiple Hydrolix tables without the enableMultiTableQuery feature flag, which is disabled by default. See Design and Configuration.
    • Multi-table queries don't support summary tables. Kibana Gateway rejects a multi-table aggregation that includes a summary table and omits summary tables from multi-table search results.
  • Management APIs aren't supported.
  • Some Query DSL features aren't supported.
  • Kibana Gateway doesn't support all Elasticsearch API endpoints. See Supported endpoints for more details.
  • JSON isn't pretty printed in responses.
  • Some advanced query parameters are ignored.
  • No support for:
    • SQL (Structured Query Language)
    • EQL (Event Query Language)
    • PPL (Piped Processing Language)
    • ES|QL (Elasticsearch Query Language)
  • Secret support is limited.

Performance limitations⚓︎

  • A single Kibana Gateway instance can process 100 concurrent HTTP requests. Requests beyond the concurrency limit receive an HTTP 429 status code.
  • Async results limits:
    • Storage size limit: 10,000 records or 500MB (whichever first).
    • Storage duration for async: 15 minutes.
    • Results aren't persisted across restarts.
  • Maximum results for each query: 10,000 records.
  • No partial results for long-running queries. All results are returned in one response once full query is finished
  • Kibana Gateway is optimized for log search and text queries. It's not as suitable for high-performance time-series metrics analysis.

Supported endpoints⚓︎

Kibana Gateway supports a subset of Elasticsearch API endpoints. After receiving a query, Kibana Gateway forwards the request to the appropriate data source such as Hydrolix or Elasticsearch. Kibana Gateway supports the following endpoints:

  • Search
    • POST /:index/_search
    • POST /_msearch, POST /:index/_msearch
    • POST /:index/_async_search
    • GET /_async_search/status/:id
    • GET /_async_search/:id, DELETE /_async_search/:id
    • GET /:index/_count
    • POST /:index/_terms_enum
    • POST /:index/_pit, DELETE /_pit
  • Schema
    • GET /:index, PUT /:index
    • GET /:index/_mapping, PUT /:index/_mapping
    • GET /:index/_field_caps, POST /:index/_field_caps
    • GET /_resolve/index/:index
    • GET /_data_stream/:pattern
    • GET /_data_stream/:pattern/_lifecycle
    • GET /_data_stream/:pattern/_stats
  • Administrative
    • GET /_cluster/health
    • POST /:index/_refresh

Warning

Kibana Gateway ignores unsupported HTTP query parameters in the endpoints listed here.