Error when I try save a policy in "Index Lifecycle"

1

When I try edit or make a new policy return this message:

Error saving lifecycle policy logs

400: Bad Request. [request body._meta]: definition for this key is missing

This is my config:

readonlyrest:
    audit_collector: true
    access_control_rules:


    - name: "::LOGSTASH::"
      auth_key: logstash:logstash
      verbosity: error

    - name: "::APM::"
      auth_key: apmserver:apmserver
      verbosity: error

    - name: "::KIBANA-SRV::"
      auth_key: kibana:kibana
      kibana_access: unrestricted

    - name: "::FILEBEAT::"
      auth_key: filebeat:filebeat
      verbosity: error

    - name: "::RO::"
      auth_key: ro:dev
      kibana_access: ro
      indices: [ ".kibana", "logstash-*"]
      kibana_hide_apps: [ "Security", "Enterprise Search"]

    - name: "::RW::"
      auth_key: rw:dev
      kibana_access: rw
      indices: [".kibana", "logstash-*"]
      kibana_hide_apps: [ "Security", "Enterprise Search"]


    - name: "::ADMIN::"
      auth_key: elastic:teste
      # KIBANA ADMIN ACCESS NEEDED TO EDIT SECURITY SETTINGS IN ROR KIBANA APP!

    - name: "::WEBSITE SEARCH BOX::"
      indices: ["public"]
      actions: ["indices:data/read/*"]

    - name: "ldapA"
      type: allow
      ldap_auth:
        name: "ldap1"
        groups: ["GG_ApoioTecnologico"]

    - name: "ldapU"
      type: allow
      ldap_auth:
        name: "ldap1"
        groups: ["GG_ELK_IGESP"]
      kibana_access: ro
      indices: [ ".kibana", "*igesp*"]
      kibana_hide_apps: [ "Security", "Enterprise Search"]

    ldaps:
.
.
.
2

When you get that error while you try to to interact with index lifecycle, what are you trying to do? And what user are you? With what kibana_access level?

Can you see if you have a “FORBIDDEN” in elasticsearch.log while you test this? If yes, please show us.

3

I am using a user without kibana_access:

user

This is my error when I save the new rule or modify any other,

Firefox_Screenshot_2021-09-20T10-28-52.842Z
Firefox_Screenshot_2021-09-20T10-28-52.842Z1912Ă—2207 198 KB

This is the log in elasticsearch with a filter “ilm”:

Capeturar
Capeturar1909Ă—980 145 KB

4

Just tried to reproduce what I see in the screenshot provided, even with `kibana_access: unrestricted´ the following test case is working:

  • Navigate to /app/management/data/index_lifecycle_management/policies
  • Create new with hot phase, rollover enabled 20 megabytes
  • hit save

Policy created successfully in my case.
@rebertty please advise if my test case is not the same as what you are doing to reproduce the issue.

Your logs show the ILM requests are being accepted, very weird Kibana is seeing a response different than the one it’s expecting.

It would be interesting to see what Kibana is getting as a response. @rebertty are you able to go to Network tab in Chrome dev tools and try to observe the response to this request?

image
image1286Ă—43 12.4 KB

5

Hi, insert “kibana_access: unrestricted” solves my problem, thanks for the attention.

1 Like