Non-standard index pattern kibana

Enterprise Support
1

ROR Version: Enterprise 1.49.1_es7.15.1

Kibana Version: 7.15.1

Elasticsearch Version: 7.15.1

Steps to reproduce the issue
create acl

    - name: "new index"
      auth_key: user:pass
      kibana_access: rw
      kibana_index: .kibana-china
      kibana_template_index: ".kibana_template"

Log in as a user in Kibana

Expected result:
.kibana-china - aliase
.kibana-china_1 - index

Actual Result:
2 indexes are created:
.kibana-china
.kibana-china_1

Because of this, I cannot create an index-patterns, perhaps dashboards.

{"ecs":{"version":"1.9.0"},"@timestamp":"2024-03-27T13:24:00.112+00:00","message":"404\nPUT /.kibana/_create/index-pattern%3A45aa8f70-ec3d-11ee-94a2-8db7fb06afb4?refresh=wait_for&require_alias=true\n{\"index-pattern\":{\"fieldAttrs\":\"{}\",\"title\":\"*:*logs-vru*\",\"timeFieldName\":\"@timestamp\",\"fields\":\"[]\",\"typeMeta\":\"{}\",\"runtimeFieldMap\":\"{}\"},\"type\":\"index-pattern\",\"references\":[],\"migrationVersion\":{\"index-pattern\":\"7.11.0\"},\"coreMigrationVersion\":\"7.15.1\",\"updated_at\":\"2024-03-27T13:24:00.103Z\"} [index_not_found_exception]: no such index [.kibana-china] and [require_alias] request flag is [true] and [.kibana-china] is not an alias","log":{"level":"DEBUG","logger":"elasticsearch.query.data"},"process":{"pid":19183}}

I created the alias manually and the error went away.
{“customer_id”: “6c4a385b-2ae8-4f02-a9cd-ef24addfb5b3”, “subscription_id”: “32d4073f-dc2f-4056-a868-842727c637cd”}

2

Thanks for the report. We will check it

3

I’ve tested it using ROR 1.56.0 for ES/KBN 1.15.1.
I cannot confirm it.

I see .kibana-china_7.15.1_001 was created with the following aliases: .kibana-china, .kibana-china-7.15.1.

Screenshot 2024-04-27 at 17.24.21
Screenshot 2024-04-27 at 17.24.211758×1048 55.6 KB

It seems that the solution would using (at least) ROR 1.56.0, instead of ROR 1.49.1.

4

Oh, I forgot to say that we will not use the new version of the Kibana index because if the large Kibana index does not work stably.
Add the following parameter to kibana.yml:

migrations.enableV2: false

5

Are you trying to say there is a bug in ROR that causes some issues? Could you please elaborate?

In general, we don’t patch old ROR versions.

6

This error was reproduced on my version
Enterprise 1.56.0_es7.15.1 :unicorn:

  1. To reproduce, you must remove all existing kibana indexes.
  2. I added a parameter to the Kibana config:
migrations.enableV2: false
  1. Launch KIbana and make a template from the Kibana index.
.kibana_template

4)log in as user:

user:pass

We get 2 indexes instead of an alias.

image
image2898×554 55.8 KB

7

ok, thanks for the detailed instructions. @Dzuming could you please take a look?

8

@Dzuming could you please take a look?

Yes. I can confirm that there is a problem with aliases when migrations.enableV2: false set. At first glance, the format of .kibana index is different, that’s why, we are not able to get correct alias values. I will try to prioritize this task.

9

Hello @driveirk
I have analyzed this issue and identified a problem related to renaming the Kibana index by changing the Kibana index suffix to _1 when

migrations.enableV2: false

This issue occurs when the ReadonlyREST plugin is uninstalled. It appears to be an unexpected behavior on the Kibana side, which has been resolved in Kibana 7.16.0 and later versions. If you need to set this flag, I recommend upgrading to a fixed version of Kibana, as this behavior affects additional ReadonlyREST plugin features, such as multi-tenancy