Issue with Kibana and Logs tab

Hello,

I am trying to setup a cluster with KB&ELK 8.6.2 and ROR 1.47.0. After i login to kibana, if i go to Stack Management->Alerts&insights->Rules and click on the Logs tab i get logged out from Kibana.
From the logs:

Apr 06 11:51:20 localhost kibana[27782]: [2023-04-06T11:51:20.457+00:00][ERROR][http] Error: No authorization filter defined!
Apr 06 11:51:20 localhost kibana[27782]:     at EventLogClient.aggregateEventsWithAuthFilter (/opt/application/Kibana/kibana-8.6.2/x-pack/plugins/event_log/server/event_log_client.js:124:13)
Apr 06 11:51:20 localhost kibana[27782]:     at RulesClient.getGlobalExecutionLogWithAuth (/opt/application/Kibana/kibana-8.6.2/x-pack/plugins/alerting/server/rules_client/rules_client.js:1012:46)
Apr 06 11:51:20 localhost kibana[27782]:     at runMicrotasks (<anonymous>)
Apr 06 11:51:20 localhost kibana[27782]:     at processTicksAndRejections (node:internal/process/task_queues:96:5)
Apr 06 11:51:20 localhost kibana[27782]:     at async /opt/application/Kibana/kibana-8.6.2/x-pack/plugins/alerting/server/routes/get_global_execution_logs.js:103:13
Apr 06 11:51:20 localhost kibana[27782]:     at async /opt/application/Kibana/kibana-8.6.2/x-pack/plugins/alerting/server/routes/lib/verify_access_and_context.js:24:14
Apr 06 11:51:20 localhost kibana[27782]:     at async /opt/application/Kibana/kibana-8.6.2/node_modules/@kbn/core-http-router-server-internal/target_node/src/error_wrapper.js:20:14
Apr 06 11:51:20 localhost kibana[27782]:     at async Router.handle (/opt/application/Kibana/kibana-8.6.2/node_modules/@kbn/core-http-router-server-internal/target_node/src/router.js:141:30)
Apr 06 11:51:20 localhost kibana[27782]:     at async handler (/opt/application/Kibana/kibana-8.6.2/node_modules/@kbn/core-http-router-server-internal/target_node/src/router.js:107:50)
Apr 06 11:51:20 localhost kibana[27782]:     at async exports.Manager.execute (/opt/application/Kibana/kibana-8.6.2/node_modules/@hapi/hapi/lib/toolkit.js:60:28)
Apr 06 11:51:20 localhost kibana[27782]:     at async Object.internals.handler (/opt/application/Kibana/kibana-8.6.2/node_modules/@hapi/hapi/lib/handler.js:46:20)
Apr 06 11:51:20 localhost kibana[27782]:     at async exports.execute (/opt/application/Kibana/kibana-8.6.2/node_modules/@hapi/hapi/lib/handler.js:31:20)
Apr 06 11:51:20 localhost kibana[27782]:     at async Request._lifecycle (/opt/application/Kibana/kibana-8.6.2/node_modules/@hapi/hapi/lib/request.js:371:32)
Apr 06 11:51:20 localhost kibana[27782]:     at async Request._execute (/opt/application/Kibana/kibana-8.6.2/node_modules/@hapi/hapi/lib/request.js:281:9)
Apr 06 11:51:20 localhost kibana[27782]: [11:51:20:470] [error][plugins][ReadonlyREST][proxyBuilder] Kibana returned an error status and the session is finished. There is probably something wrong with your configuration files and the ReadonlyREST Elasticsearch security plugin for Kibana could not work properly.
Apr 06 11:51:20 localhost kibana[27782]: [11:51:20:471] [error][plugins][ReadonlyREST][proxyBuilder] Kibana returned an error status and the session is finished. There is probably something wrong with your configuration files and the ReadonlyREST Elasticsearch security plugin for Kibana could not work properly.
Apr 06 11:51:20 localhost kibana[27782]: Error: Kibana returned an error status and the session is finished. There is probably something wrong with your configuration files and the ReadonlyREST Elasticsearch security plugin for Kibana could not work properly.

Is this a bug? Could you please help?

Also, before (with 7.17 version and below) and before the universal builds we were using this endpoint
.readonlyrest/_settings/1 to check or update the readonlyrest index. I see now that this endpoint it is not working anymore. What can we use instead?

Thanks,
Diana

1 Like

Hello @Diana,

@Dzuming will have a look at ensuring the compatibility with latest Alerts.

About the direct access to ROR settings, it should technically be still possible to do it, as our Kibana ROR settings app still writes the settings in that index.
How is it not working? Can you be more specific?

However, we have a more specific API for ROR settings. It’s internal, but still puts you in a much better place than writing raw documents in .readonlyrest index!

@coutoPL can you share with @Diana the new internal API for configuration read/validate+write ?

Hello,

When trying to make a request to .readonlyrest/settings/1 endpoint we get the following answer:
“error”:“no handler found for uri [/.readonlyrest/settings/1] and method [PUT]” (the same for GET).