After upgrade some curl commands does not work

1

HI all,

i upgraded our elastic/kibana system from 9.1.7-ror-1.68.0 to 9.4.1-ror-1.70.1, and after we run below commands

curl --insecure -u admin:xxxx-XGET ‘https ://collector-kibana/api/stats’
curl --insecure -u admin:xxxx-XGET ‘https ://collector-kibana/api/status’

getting output:

HTTP/1.1 302 Found. Redirecting to /logout?nextUrl=%2Fapi%2Fstats

in previous version it worked and we got info from system. Our analysts cannot use api now.

in kibana debug readonlyrest logs i found after run above commands:

[2026-08-25T11:20:53.609+00:00][debug][plugins][ReadonlyREST][authenticationFacade][x-ror-correlation-id=211374b4-f1e1-4c3b-a3a6-9ff68b6cee26] All request headers from /api/stats: { connection: ‘close’, host: ‘host.docker.internal:5602’, authorization: ‘’, ‘user-agent’: ‘curl/8.5.0’, accept: ‘/’ }
[2026-08-25T11:20:53.636+00:00][debug][plugins][ReadonlyREST][rorRequest][x-ror-correlation-id=061aaf53-3de2-44b4-8488-ebb6146b9701] User request identity not available for last session activity date
[2026-08-25T11:20:53.644+00:00][debug][plugins][ReadonlyREST][indexCreator][x-ror-correlation-id=061aaf53-3de2-44b4-8488-ebb6146b9701] isMigrationNeeded “/alias” endpoint data { ‘.kibana_9.1.7_001’: { aliases: { ‘.kibana’: { is_hidden: true }, ‘.kibana_9.4.1’: { is_hidden: true } } } }
[2026-08-25T11:20:53.644+00:00][debug][plugins][ReadonlyREST][indexCreator][x-ror-correlation-id=061aaf53-3de2-44b4-8488-ebb6146b9701] isMigrationNeeded kibanaIndexVersion: 9.1.7
[2026-08-25T11:20:53.644+00:00][debug][plugins][ReadonlyREST][indexCreator][x-ror-correlation-id=061aaf53-3de2-44b4-8488-ebb6146b9701] isMigrationNeeded kibanaBaseVersion: 9.4.1
[2026-08-25T11:20:53.644+00:00][debug][plugins][ReadonlyREST][indexCreator][x-ror-correlation-id=061aaf53-3de2-44b4-8488-ebb6146b9701] isMigrationNeeded indexBaseVersion 9.1.7
[2026-08-25T11:20:53.684+00:00][debug][plugins][ReadonlyREST][rorRequest][x-ror-correlation-id=061aaf53-3de2-44b4-8488-ebb6146b9701] getTenancyId called with undefined SID
[2026-08-25T11:20:53.849+00:00][warning][plugins][ReadonlyREST][indexBasedSessionManager][x-ror-correlation-id=061aaf53-3de2-44b4-8488-ebb6146b9701] Failed to decode session for SID 3ef47e67-5836-48bd-97c0-5e8a5495cf18: Session not found in index
[2026-08-25T11:20:53.849+00:00][debug][plugins][ReadonlyREST][indexBasedSessionManager][x-ror-correlation-id=061aaf53-3de2-44b4-8488-ebb6146b9701] SID 3ef47e67-5836-48bd-97c0-5e8a5495cf18 not found in in-index session storage either: giving up.

Did someone meet with this kind of issue ? Thank you for any help.

3

Hello @frantisek.kavecky

Have you server.basePath configured it in your kibana.yml? If yes, could you update your CURL URL and add it like https ://collector-kibana/<BASE_PATH>/api/stats?

4

We do not have server.basePath definied, but we have

server.publicBaseUrl: “https://collector-kibana”

5

Could you provide your full kibana.yml and readonlyrest.yml files? You can send it as a private message on a forum. I will try to reproduce the problem locally.

6

kibana.yml :

server.port: 5601

server.host: “0.0.0.0”

server.publicBaseUrl: “https://collector-kibana”

server.name: “collector-kibana”

server.xsrf.disableProtection: true

server.ssl.enabled: true
server.ssl.certificate: /usr/share/kibana/config/collector-kibana.pem
server.ssl.key: /usr/share/kibana/config/collector-kibana.key

elasticsearch.hosts: [“https://worker01:9200”,“https://worker02:9200”]

readonlyrest_kbn.logLevel: debug

elasticsearch.username: “kibana”
elasticsearch.password: “kibana”

elasticsearch.requestHeadersWhitelist: [ authorization ]

elasticsearch.ssl.certificateAuthorities: [ “/usr/share/kibana/config/root-ca.crt” ]

xpack.reporting.roles.enabled: false
xpack.reporting.encryptionKey: “Kibana_find_everything_for_you”
xpack.encryptedSavedObjects.encryptionKey: “Kibana_find_everything_for_you”
xpack.security.encryptionKey: “Kibana_find_everything_for_you”

xpack.reporting.queue.timeout: 10m

readonlyrest_kbn.login_title: “collector kibana Login in form: ‘username@hq.com’”
readonlyrest_kbn.login_subtitle: “Please login using your HQ credentials.”
readonlyrest_kbn.login_html_head_inject: ’ body { background: linear-gradient(90deg,#0096a1 0,#0096a1 80%,#0096a1 100%); } ’
readonlyrest_kbn.cookiePass: “ror-cookie-for-multiple-kibana-instances”
readonlyrest_kbn.store_sessions_in_index: true
readonlyrest_kbn.sessions_probe_interval_seconds: 300

7

Hello @frantisek.kavecky

I was able to reproduce the issue only in the case of

curl --insecure -u admin:xxxx-XGET ‘https ://collector-kibana/api/stats’
  1. Could you comment out xpack.reporting.queue.timeout: 10mIn your kibana.yml, and try to CURL again?
  2. Could you confirm that it api/statusis also affected by this issue? This URL is whitelisted by default, so it shouldn’t be processed by the plugin, but go straight to the Kibana server
  3. If api/statusis affected. Could you send the full log from the moment of the curl send?
8

After some restart api/status is working. It is weird because it was not. I commented out as you proposed:
#xpack.reporting.queue.timeout: 10m

and now is working api/status also api/stats.

It is necessary to have xpack.reporting.queue.timeout in kibana.yml ? Thank you for your help !

9

It is necessary to have xpack.reporting.queue.timeout in kibana.yml ?

From a ReadonlyREST Kibana plugin, there is no need to have this value configured in a kibana.yml;

However, as a workaround for this issue, instead of removing a property from a config, until we release a new version with a fix, you can change the value from a time string to milliseconds, like:

xpack.reporting.queue.timeout: 60000
10

great , it is working thank you !!

11

ROR 1.71.0 fixed this issue