Errors after upgrade Kibana 7.17.29 to 8.19.7

coutoPL · January 16, 2026, 12:11pm

We double-checked this on our side and, with a standard ES/Kibana 8.19.7 + ROR setup, we cannot reproduce the issue.

We prepared a reproducer in our ROR sandbox: [RORDEV-1912] Reproduction by Dzuming · Pull Request #91 · beshu-tech/ror-sandbox · GitHub

You can run it locally (Docker only) - instructions are in the PR description. In our environment, the scenario works as expected, so please feel free to test it on your side.

If you can reproduce your exact problem in the sandbox, please come back here - we will treat it as a potential ROR bug and try to fix it. If it works fine in the sandbox, the root cause is most likely in your cluster/configuration; with a Free license, we cannot spend more time on deep, case-specific analysis. For production multitenancy, we recommend the Enterprise license, where it works out of the box and comes with support.

mikeIT · January 16, 2026, 12:40pm

Thank you very much for assistance. I will try to test the sandbox. Could I additionally ask what ROR user should be seen as “Processed by“ for report generation if “ldap“ would be used and in kibana config kibana.index?

coutoPL · January 16, 2026, 2:01pm

In the “Processed by” field, you would not see any user but the Kibana node, which handled the report generation. E.g.:

BTW, don’t focus on the LDAP rule. In the example, we used the auth_key rule instead. It doesn’t matter in this case what authentication method is used.