KibanaIsServerless check causes 400 Bad Request errors on Stateful Kibana

[strawgate]

Our new KibanaIsServerless check causes hard to track down noise in the Kibana log in stateful environments.

From discuss: https://discuss.elastic.co/t/elasticsearch-output-of-filebeat-is-empty-displays-http-error-400-bad-request/352407

elastic-agent-libs/kibana/client.go

Lines 351 to 359 in 4739839

	func (client *Client) KibanaIsServerless() (bool, error) {
	ret, _, err := client.Connection.Request("GET", "/api/saved_objects/_find", nil, nil, nil)
	if ret > 300 && strings.Contains(err.Error(), "not available with the current configuration") {
	return true, nil
	} else if err != nil {
	return false, fmt.Errorf("error checking serverless status: %w", err)
	}
	return false, nil
	}

GET kbn:/api/saved_objects/_find
{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "[request query.type]: expected at least one defined value but got [undefined]"
}

[cmacknz]

@fearful-symmetry I think at the time we wrote this there wasn't a better way to tell if we were connected to serverless Kibana, so instead we used an API that didn't exist in stateful, correct?

Were there ever plans to implement an API for this detection? Or is that something we need to follow up on?

[strawgate]

My uneducated guess is this call returns:
method [get] exists but is not available with the current configuration
with a 400 error on serverless

and returns

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "[request query.type]: expected at least one defined value but got [undefined]"
}

with a 400 error on stateful

Fixing it on stateful may just require giving it the required query parameter like: kbn:/api/saved_objects/_find?type=index-pattern -- that's all that's required for it to not return an error for me

Ideally a dedicated API would be better but adding the type would be a quick fix here

[fearful-symmetry]

@cmacknz yah, at the time that code was written, we didn't really have a good way to detect serverless mode in Kibana. It's totally a hack (I even called it a hack in the commit). However, that was a long time ago, and hopefully the API has changed. I can ask the slack channel.

[fearful-symmetry]

Looks like this will end up in serverless deployments soon: elastic/kibana#176477

[afharo]

Hey! I just found out this behavior and was about to report it. Glad that you had it on your radar.

Just letting you know that GET /api/status already reports the version.build_flavor: "traditional" | "serverless".

You can rely on that now.

[lukeelmers]

@cmacknz @strawgate @fearful-symmetry /api/saved_objects/_find has been deprecated for awhile now and @elastic/kibana-core is proposing removing it in 9.0. So at this point you should migrate to using the build_flavor from /api/status as mentioned in the link above. This is the "official" way of determining whether you are talking to serverless Kibana. As long as you are authenticated, you should get version.build_flavor back in the response. (Unauthenticated requests to /api/status will not include this info).

[fearful-symmetry]

@pierrehilbert we should put this on the board for the next 1-2 sprints or something; this is probably an easy fix