Huge PUT request to index pattern during discovery causing Payload content length greater than maximum allowed

[eirikbell]

Kibana version:
6.4.0

Elasticsearch version:
6.4.0

Server OS version:
Official docker container
docker.elastic.co/kibana/kibana:6.4.0

Original install method (e.g. download page, yum, from source, etc.):
Official docker container
docker.elastic.co/kibana/kibana:6.4.0

Describe the bug:
On Discovery tab when opening a saved search with filters to our logs* index-pattern, an error is displayed in red in top; "Payload content length greater than maximum allowed: 1048576". When the error occur, javascript fails to continue drawing the gui, resulting in saved filters not appearing and unable to add a new filter. The filter is affecting the query to elasticsearch but does not display.

Investigating network traffic reveals that a PUT request to http://DOMAIN/api/saved_objects/index-pattern/metricbeat-* responds with 400 and Payload content length greater than maximum allowed: 1048576

Attempted to delete the index pattern and recreate through metricbeat (6.4.0 official docker image) with same result.

Investigating payload from Kibana reveals that payload size on the put from kibana gui is Content-Length: 1077758

Resolved by setting Kibana config in kibana.yml: server.maxPayloadBytes: 2097152

Seems rather unnecessary that Kibana is sending a request of more than 1 MB as a PUT request on an index pattern from a client browser on an index pattern not even relevant for the current task.

Steps to reproduce:

1. Let metricbeat create index pattern
2. Inspect size of index pattern document
3. Adjust Kibana config server.maxPayloadBytes to less than size of index pattern
4. Open Discover in Kibana with a saved search including filters

Expected behavior:
Browser should not attempt to PUT 1 MB of pauload to the index pattern

Provide logs and/or server output (if relevant):
Tom long to post, the whole > 1 MB payload in log

Any additional context:
Upgraded from 6.3.1 to 6.4.0 5 days previous to the error started occuring. Affects all users of Kibana.

[tylersmalley]

@elastic/kibana-management

[bmcconaghy]

@elastic/kibana-app I think this is an issue with discover and the setting of favorite fields.

[lukasolson]

@bmcconaghy Yeah I think you're right, that's causing the request here. Do we have any plans to have APIs for partial updates to the index pattern?

[lukasolson]

Not to say we couldn't implement this on the kibana-app team obviously, just wondering if there were already any other plans for this sort of API

[bmcconaghy]

@lukasolson we have no plans in that direction currently, but it would totally make sense to have a patch update rather than writing the entire index pattern data all over again. The main issue with that is that the index pattern info is just stored as a string, but obviously that is not an insurmountable problem.

[elasticmachine]

Pinging @elastic/kibana-app-services (Team:AppServices)

[mattkime]

fixed by #83368