Kibana Index Pattern field discovery concurrency configuration

Answer

Kibana treats each "Refresh field list" operation as a write to the index‑pattern saved object in the .kibana index. The write is performed through the Saved Objects service, which uses Elasticsearch’s optimistic concurrency control (OCC) – the seq_no/primary_term pair in 8.x (or version/version_type in 7.x). If two refreshes try to update the same document at the same time, the second write that carries an stale version fails with HTTP 409, preventing an outdated field list from overwriting a newer one.

Confirmed facts

• The field discovery query calls Elasticsearch’s _field_caps (or the legacy _fields_for_wildcard) API and returns a complete field list.
• That list is written as a single JSON blob to the index‑pattern document; readers see either the old or the new complete list, never a partially merged result.
• Kibana’s server‑side field‑caps cache (keyed by the index‑pattern expression) can cause simultaneous refreshes of the same pattern to share the same Elasticsearch call, reducing load.
• There is no user‑facing kibana.yml setting to throttle field‑list refreshes or to tune the OCC behavior; the mechanism relies entirely on the Saved Objects service.

Likely explanation / version‑dependent behavior

Whether the refresh code path actually sends the current saved‑object version (thus triggering the 409 conflict) depends on the Kibana version and the specific plugin implementation. In recent 8.x releases the index‑pattern management plugin does pass the version, but this has not been verified for all 7.x streams.

Steps to verify for your deployment

1. Confirm your Kibana version (e.g., via GET /api/status or the footer in the UI).
2. Enable debug logging for the savedObjects and indexPatternManagement categories (logging.verbose: true in kibana.yml or via runtime API).
3. Open two browser sessions on the same Data View, click “Refresh field list” at nearly the same time, and watch the server logs for:
• Elasticsearch _field_caps calls (should be deduplicated by the server cache).
• Saved Objects UPDATE requests with if_seq_no/if_primary_term parameters.
• Any HTTP 409 responses indicating a version conflict.
4. After the refreshes, retrieve the index‑pattern document (GET .kibana/_doc/index-pattern:) and verify that the fields (or fieldCaps) attribute contains a single, self‑consistent list.

Missing diagnostic detail that would change the recommendation

If you are running a Kibana version prior to 7.10 (where the Saved Objects OCC fields were not consistently passed), the refresh path may rely on a last‑write‑wins update, making stale overwrites possible. Knowing your exact Kibana version determines whether you need to rely on the server‑side cache alone or consider upgrading to obtain the OCC protection.