Hi,
Elastic and Kibana 7.16.2
RoR Enterprise 1.37.0
We are trying to reorganize and futuru proof our indices layout.
We plannend on using aliases for indices for this.
But I can’t seem to get Kibana to allow access to the alias of a index.
Setup:
- Create a data stream
POST logs-random-indexname/_doc
{
"message": "logged the request",
"@timestamp": "1591890612"
}
Please note, this example creates a document in 1970 
- Apply an alias
POST _aliases
{
"actions": [
{
"add": {
"index": "logs-random-indexname",
"alias": "roa-logs-random-indexname"
}
}
]
}
- Give permissions via RoR rules:
- name: "custom kibana ro"
indices: ["kibana_custom"]
kibana_access: rw
kibana_index: "kibana_custom"
kibana_hide_apps: ["Analytics|Maps", "Analytics|Overview", "Observability", "Security", "readonlyrest_kbn", "Analytics|Canvas", "Management", "Enterprise Search"]
groups: ["custom_ro"]
- name: "Custom data access rule"
indices: ["roa-logs-random-*"]
actions: ["indices:data/read/*", "indices:admin/resolve/index"]
groups: ["custom_admin", "custom_ro"]
- name: "custom kibana admin"
indices: ["kibana_custom"]
kibana_index: "kibana_custom"
groups: ["custom_admin"]
users:
- username: myloginname
auth_key_sha256: my_hash
groups: ["custom_admin"]
- Login with user myloginname and open discover for the index pattern:
roa-logs-random-*
- No data found
I tried several configurations:
indices: ["roa-logs-random-indexname"]
indices: ["roa-logs-random-indexname", "logs-random-indexname"]
indices: ["roa-*", "logs-random-*"]
indices: ["roa-logs-random-*", "logs-random-indexname"]
indices: ["roa-logs-random-indexname", "logs-random-indexname"]
indices: ["roa-*", "random-*"]
Result is always index not found.
I also tried from dev tools doing the query directly
GET /roa-logs-random-indexname/_search
This works.
If you try
GET /roa-logs-random-*/_search
It doesn’t work,
You get
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 0,
"successful" : 0,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 0,
"relation" : "eq"
},
"max_score" : 0.0,
"hits" : [ ]
}
}
If you make a index pattern for:
roa-logs-random-indexname
It works.
So my initial conclusion was, somehow it is not resolving the data stream alias correctly…
But, if i configure the indices rule as:
indices: ["roa-logs-random-indexname", "*"]
It suddenly works for index pattern roa-logs-random-* as well.
End conclusion:
Wildcard resolving of data stream aliases in the indices section seems somehow broken?
(Topic was adjusted after more troubleshooting)
