Kibana failed to export or filter saved objects if result window is too large

[lystor]

Kibana version:
7.14.1

Elasticsearch version:
7.14.1

Server OS version:
Official Docker images.

Describe the bug:
Kibana fails to export or filter saved objects if their number exceeds 10.000.

Steps to reproduce:

1. Create 11000 saved objects
2. Run export saved objects

Expected behavior:

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):
{
"statusCode": 400,
"error": "Bad Request",
"message": "all shards failed: search_phase_execution_exception: [illegal_argument_exception] Reason: Result window is too large, from + size must be less than or equal to: [10000] but was [11000]. See the scroll api for a more efficient way to request large data sets. This limit can be set by changing the [index.max_result_window] index level setting.",
}

[zaidizeeshan]

you need to find the related index name in elasticsearch error logs and use the below command to change the settings using curl. However, scroll api calls, index name need not be mentioned but you must try it for single index
curl -X PUT “https://localhost:9200/YOUR_INDEX_NAME/_settings” -H ‘Content-Type: application/json’ -d ‘{ “index” : { “max_result_window” : 11000 } }’
if you enabled x-pack security then you need to specify username also i.e.
curl -u elastic -X PUT “https://localhost:9200/YOUR_INDEX_NAME/_settings” -H ‘Content-Type: application/json’ -d ‘{ “index” : { “max_result_window” : 11000 } }’
output would be:

Enter host password for user 'elastic':
{"acknowledged":true}

or update all existing indices from the api

PUT _settings
{
  "index.max_result_window": 11000
}

you can also create the template to take effect on future indices that targets specific index patterns (or just * for global)

PUT _template/example
{
  "index_patterns": ["YOUR_INDEX_NAME*"],
  "settings": {
    "index.max_result_window": 11000
  }
}

PUT YOUR_INDEX_NAME

output would be:

GET YOUR_INDEX_NAME
...

{
  "YOUR_INDEX_NAME" : {
    "aliases" : { },
    "mappings" : { },
    "settings" : {
      "index" : {
        ...
        "max_result_window" : "11000",
        ...
      }
    }
  }
}

another way
if the above solutions didn't work for you then try to post the request using scroll_id and scroll_time without defining the indices. For scroll api calls, index name need not be mentioned.
you can this also:
POST <host_name>:<port_num>/_search?scroll=1m&scroll_id=<scroll_id>
ref.: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-scroll.html
https://www.elastic.co/guide/en/elasticsearch/reference/current/paginate-search-results.html#scroll-search-results

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[lukeelmers]

I'm surprised to see this reported for 7.14, as we introduced support for exporting >10k objects in 7.12: #89915

Are you certain this is a 7.14 deployment?

Note that you will need to increase the savedObjects.maxImportExportSize in the Kibana config if you want to export more than 10k objects (which is the default).

[pgayvallet]

I'm surprised to see this reported for 7.14, as we introduced support for exporting >10k objects in 7.12

The HTTP API supported it, but the UI didn't in 7.14. This was fixed on 7.16 in #118335

[lukeelmers]

The HTTP API supported it, but the UI didn't in 7.14

Ah of course 🤦 Thanks for updating.