Kibana gives "404 page not found" after upgrade from 3.0.0 to 3.1.0 #15945
Answered
by
Zer0-cyber-web
Zer0-cyber-web
asked this question in
3.0
Version3.1.0 Installation MethodSecurity Onion ISO image Descriptionupgrading Installation TypeStandalone Locationon-prem with Internet access Hardware SpecsExceeds minimum requirements CPU12 RAM64 Storage for /256Gb Storage for /nsm16T Network Traffic Collectionspan port Network Traffic Speeds1Gbps to 10Gbps StatusNo, one or more services are failed (please provide detail below) Salt StatusYes, there are salt failures (please provide detail below) LogsYes, there are additional clues in /opt/so/log/ (please provide detail below) DetailHi! [root@secon ~]# curl -i -L -H "Accept: */*" http://localhost:5607/kibana
curl: (7) Failed to connect to localhost port 5607: Connection refused[root@secon ~]# curl localhost:9200/_cat/indices | grep kibana
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
curl: (52) Empty reply from serverso-status gives all green: so-elasticsearch-query _cluster/health - is also green [root@secon ~]# so-elasticsearch-query _cluster/health
{"cluster_name":"securityonion","status":"green","timed_out":false,"number_of_nodes":1,"number_of_data_nodes":1,"active_primary_shards":1000,"active_shards":1000,"relocating_shards":0,"initializing_shards":0,"unassigned_shards":0,"unassigned_primary_shards":0,"delayed_unassigned_shards":0,"number_of_pending_tasks":0,"number_of_in_flight_fetch":0,"task_max_waiting_in_queue_millis":0,"active_shards_percent_as_number":100.0}Last logs from Kibana:{"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2026-05-28T15:00:06.899+00:00","message":"taskManager plugin is now degraded: Task Manager is unhealthy - Reason: setting HealthStatus.Error because of expired hot timestamps","log":{"level":"WARN","logger":"status.plugins.taskManager"},"process":{"pid":6,"uptime":8060.903125766},"trace":{"id":"8ae66904d19e452a8f1d5e9cb52383da"},"transaction":{"id":"bd9fa9be79b9c8a7"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2026-05-28T15:00:06.986+00:00","message":"Kibana is now degraded (was available): 0 service(s) and 1 plugin(s) are degraded: taskManager","log":{"level":"WARN","logger":"status"},"process":{"pid":6,"uptime":8060.989307711},"trace":{"id":"8ae66904d19e452a8f1d5e9cb52383da"},"transaction":{"id":"bd9fa9be79b9c8a7"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2026-05-28T15:00:07.322+00:00","message":"Error occurred while publishing Fleet metrics: RequestAbortedError: Request has been aborted by the user","log":{"level":"WARN","logger":"plugins.fleet"},"process":{"pid":6,"uptime":8061.326321603},"span":{"id":"0d347bacac3effb1"},"trace":{"id":"cd77006b1ec4b4618b30128c33bb9224"}} {"rule":{"id":"d7741c42-d1cb-4a64-91b7-4c42d145d446","uuid":"ac2879a9-1aac-4043-a2a4-4c2163a609e4","name":"Endpoint auth detection","type":"siem.queryRule","execution":{"uuid":"d0f4716b-010f-4732-a825-69f99733f69c","status":"failed"}},"kibana":{"spaceId":"default"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2026-05-28T15:00:08.239+00:00","message":"Changing rule status to \"failed\". index: \".ds-logs-endpoint.events.api-default-2025.07.23-000001\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2025.08.22-000002\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2025.09.21-000003\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2025.10.21-000004\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2025.11.20-000005\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2025.12.20-000006\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2026.01.19-000007\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2026.02.18-000008\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2026.03.20-000009\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.07.23-000001\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.08.22-000002\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.09.21-000003\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.10.21-000004\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.11.20-000005\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.12.20-000006\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2026.01.19-000007\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2026.02.18-000008\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2026.03.20-000009\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.library-default-2025.07.23-000001\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.library-default-2025.08.22-000002\" type: \"no_shard_available_action_exception\" [siem.queryRule][Endpoint auth detection][rule id d7741c42-d1cb-4a64-91b7-4c42d145d446][rule uuid ac2879a9-1aac-4043-a2a4-4c2163a609e4][exec id d0f4716b-010f-4732-a825-69f99733f69c][space default]","log":{"level":"ERROR","logger":"plugins.securitySolution.ruleExecution"},"process":{"pid":6,"uptime":8062.242741924},"trace":{"id":"6c6441dd0253a67628ecd7a5f9dd2033"},"transaction":{"id":"aef5cdff11252381"}} {"tags":["d7741c42-d1cb-4a64-91b7-4c42d145d446","siem.queryRule","rule-run-failed","framework-error"],"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2026-05-28T15:00:08.407+00:00","message":"Executing Rule siem.queryRule:d7741c42-d1cb-4a64-91b7-4c42d145d446 has resulted in the following error(s): index: \".ds-logs-endpoint.events.api-default-2025.07.23-000001\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2025.08.22-000002\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2025.09.21-000003\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2025.10.21-000004\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2025.11.20-000005\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2025.12.20-000006\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2026.01.19-000007\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2026.02.18-000008\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.api-default-2026.03.20-000009\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.07.23-000001\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.08.22-000002\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.09.21-000003\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.10.21-000004\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.11.20-000005\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2025.12.20-000006\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2026.01.19-000007\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2026.02.18-000008\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.file-default-2026.03.20-000009\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.library-default-2025.07.23-000001\" type: \"no_shard_available_action_exception\", index: \".ds-logs-endpoint.events.library-default-2025.08.22-000002\" type: \"no_shard_available_action_exception\"","log":{"level":"ERROR","logger":"plugins.alerting.siem.queryRule"},"process":{"pid":6,"uptime":8062.410961731},"trace":{"id":"6c6441dd0253a67628ecd7a5f9dd2033"},"transaction":{"id":"aef5cdff11252381"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2026-05-28T15:00:10.964+00:00","message":"taskManager plugin is now available: Task Manager is healthy","log":{"level":"INFO","logger":"status.plugins.taskManager"},"process":{"pid":6,"uptime":8064.967262405},"trace":{"id":"0497291d8fc7fff94ceac054bde60b48"},"transaction":{"id":"319786fd23d83d57"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2026-05-28T15:00:11.044+00:00","message":"Kibana is now available (was degraded)","log":{"level":"INFO","logger":"status"},"process":{"pid":6,"uptime":8065.047855707},"trace":{"id":"0497291d8fc7fff94ceac054bde60b48"},"transaction":{"id":"319786fd23d83d57"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2026-05-28T15:00:52.033+00:00","message":"Error writing some bulk events","error":{"message":"Error writing some bulk events","type":"Error","stack_trace":"Error: Error writing some bulk events\n at ClusterClientAdapter.indexDocuments (/usr/share/kibana/node_modules/@kbn/event-log-plugin/server/es/cluster_client_adapter.js:130:23)\n at processTicksAndRejections (node:internal/process/task_queues:95:5)\n at /usr/share/kibana/node_modules/@kbn/event-log-plugin/server/es/cluster_client_adapter.js:46:201\n[\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: 'b51b3972-0cee-4161-86a7-f7685f6fed5a',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '0d180eab-4b57-4ef3-935a-c352236c1402',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '8a19bc14-4dea-4123-80c1-5c518b762b66',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: 'dad92e58-fb85-4646-9648-bb4e36e7237d',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '2FQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '2VQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '2lQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '21QZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '3FQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '3VQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '3lQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '31QZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '4FQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '4VQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '4lQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '41QZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '5FQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '5VQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '5lQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '51QZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: 'e6c6f9b5-2b0f-4762-8a38-9527ab29faeb',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '6FQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '6VQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: 'ea101d1f-28fe-4fee-ba42-df5965429ea9',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: 'ab5151db-f99a-4f26-82cd-60987d37a9b9',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '6lQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '61QZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '7FQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '7VQZb54BjVIVqDNnVmWW',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n },\n {\n create: {\n _index: '.kibana-event-log-ds',\n _id: '5f5a3073-77e6-46b5-b9c7-a1c2ef0cf1dc',\n status: 503,\n failure_store: 'not_enabled',\n error: {\n type: 'unavailable_shards_exception',\n reason: '[.ds-.kibana-event-log-ds-2026.05.19-000073][0] primary shard is not active Timeout: [1m], request: [BulkShardRequest [[.ds-.kibana-event-log-ds-2026.05.19-000073][0]] containing [30] requests]'\n }\n }\n }\n]"},"log":{"level":"ERROR","logger":"plugins.eventLog"},"process":{"pid":6,"uptime":8106.036382491},"trace":{"id":"cbe0fc75ca92a5ea2785221ec4416489"},"transaction":{"id":"dcb74820f87ba881"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2026-05-28T15:00:55.637+00:00","message":"Error occurred while publishing Fleet metrics: RequestAbortedError: Request has been aborted by the user","log":{"level":"WARN","logger":"plugins.fleet"},"process":{"pid":6,"uptime":8109.640262446},"span":{"id":"568101da4ede5d75"},"trace":{"id":"cd77006b1ec4b4618b30128c33bb9224"}} {"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:12.097+00:00","message":"Kibana is starting","log":{"level":"INFO","logger":"root"},"process":{"pid":7,"uptime":9.648321308}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:12.241+00:00","message":"Kibana process configured with roles: [background_tasks, ui]","log":{"level":"INFO","logger":"node"},"process":{"pid":7,"uptime":9.714678739},"trace":{"id":"9829239bbe4959609665fa1bd47cda83"},"transaction":{"id":"0cff3c050c9b3304"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:38.490+00:00","message":"The following plugins are disabled: \"apm,automaticImportVTwo,cloudChat,cloudExperiments,cloudFullStory,dataUsage,developerToolbar,inspectComponent,profilingDataAccess,profiling,securitySolutionServerless,serverless,serverlessObservability,serverlessSearch\".","log":{"level":"INFO","logger":"plugins-service"},"process":{"pid":7,"uptime":36.137878798},"trace":{"id":"9829239bbe4959609665fa1bd47cda83"},"transaction":{"id":"0cff3c050c9b3304"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:38.490+00:00","message":"Plugins \"ux\" have been disabled since the following direct or transitive dependencies are missing, disabled, or have incompatible types: [apm].","log":{"level":"INFO","logger":"plugins-service"},"process":{"pid":7,"uptime":36.138687097},"trace":{"id":"9829239bbe4959609665fa1bd47cda83"},"transaction":{"id":"0cff3c050c9b3304"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:38.666+00:00","message":"http server running at http://0.0.0.0:5601","log":{"level":"INFO","logger":"http.server.Preboot"},"process":{"pid":7,"uptime":36.139490211},"trace":{"id":"9829239bbe4959609665fa1bd47cda83"},"transaction":{"id":"0cff3c050c9b3304"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:39.111+00:00","message":"Access to uri [/api/fleet/settings] with method [get] is not available with the current configuration","log":{"level":"ERROR","logger":"http.server.kbn-internal-api-restricted"},"process":{"pid":7,"uptime":36.59259234},"trace":{"id":"0d6ae77ec8b2e4ab27e6d302ed860c01"},"transaction":{"id":"c23bb7bfe4fe0e71"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:39.171+00:00","message":"Access to uri [/] with method [get] is not available with the current configuration","log":{"level":"ERROR","logger":"http.server.kbn-internal-api-restricted"},"process":{"pid":7,"uptime":36.647459426},"span":{"id":"7076c1608079ba26"},"trace":{"id":"bb5678a95b40d3ae9b0b9a661e6452a0"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:39.308+00:00","message":"Setting up [1] plugins: [interactiveSetup]","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":36.786344035},"trace":{"id":"9829239bbe4959609665fa1bd47cda83"},"transaction":{"id":"0cff3c050c9b3304"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:39.418+00:00","message":"You should set server.basePath along with server.rewriteBasePath. Starting in 7.0, Kibana will expect that all requests start with server.basePath rather than expecting you to rewrite the requests in your reverse proxy. Set server.rewriteBasePath to false to preserve the current behavior and silence this warning.","log":{"level":"WARN","logger":"config.deprecation"},"process":{"pid":7,"uptime":36.891340653},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:39.418+00:00","message":"TLS is not enabled, or the HTTP protocol is set to HTTP/1. Enabling TLS and using HTTP/2 improves security and performance.","log":{"level":"WARN","logger":"config.deprecation"},"process":{"pid":7,"uptime":36.89187797},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:39.761+00:00","message":"Setting up [189] plugins: [devTools,translations,screenshotMode,usageCollection,telemetryCollectionManager,telemetryCollectionXpack,kibanaUsageCollection,contentManagement,cloud,intercepts,productIntercept,newsfeed,savedObjectsFinder,noDataPage,monitoringCollection,licensing,taskManager,share,sampleDataIngest,productDocBase,reindexService,mapsEms,globalSearch,globalSearchProviders,features,banners,licenseApiGuard,customBranding,ftrApis,fieldsMetadata,fieldFormats,expressions,screenshotting,dataViews,esUiShared,dataSourcesRegistry,customIntegrations,home,searchprofiler,painlessLab,management,spaces,security,telemetry,licenseManagement,indicesMetadata,snapshotRestore,lists,files,encryptedSavedObjects,taskManagerDependencies,entityManager,eventLog,actions,notifications,inference,workflowsExtensions,workflowsExecutionEngine,llmTasks,genAiSettings,dataConnectors,cloudConnect,aiAssistantManagementSelection,advancedSettings,data,savedObjectsTagging,globalSearchBar,savedObjectsManagement,embeddable,uiActionsEnhanced,imageEmbeddable,savedSearch,presentationUtil,metricsDataAccess,logsDataAccess,fileUpload,esql,metricsExperience,ecsDataQualityDashboard,dataViewFieldEditor,console,searchSynonyms,searchQueryRules,searchNotebooks,searchGettingStarted,ingestPipelines,charts,watcher,apmSourcesAccess,apmDataAccess,cloudDataMigration,grokdebugger,cps,unifiedSearch,navigation,visualizations,visTypeXy,visTypeVislib,visTypeVega,visTypeTimelion,visTypeTagcloud,visTypeTable,visTypeMetric,visTypeMarkdown,visTypeHeatmap,inputControlVis,expressionTagcloud,expressionPartitionVis,visTypePie,expressionMetricVis,expressionLegacyMetricVis,expressionHeatmap,expressionGauge,visTypeGauge,eventAnnotation,expressionXY,visTypeTimeseries,lens,maintenanceWindows,alerting,inferenceEndpoint,graph,dataViewManagement,controls,triggersActionsUi,transform,stackConnectors,workflowsManagement,onechat,searchHomepage,observabilityAIAssistant,dashboard,links,dashboardMarkdown,dashboardEnhanced,dashboardAgent,automaticImport,stackAlerts,ruleRegistry,streams,cases,timelines,sessionView,kubernetesSecurity,aiops,agentBuilderPlatform,maps,dataVisualizer,discover,reporting,canvas,ml,searchPlayground,searchInferenceEndpoints,searchAssistant,observabilityAiAssistantManagement,observabilityAgentBuilder,logsShared,upgradeAssistant,elasticAssistant,fleet,osquery,monitoring,logstash,indexManagement,searchIndices,rollup,remoteClusters,crossClusterReplication,indexLifecycleManagement,contentConnectors,enterpriseSearch,datasetQuality,streamsApp,dataQuality,cloudSecurityPosture,cloudDefend,securitySolution,securitySolutionEss,exploratoryView,observability,uptime,slo,synthetics,observabilityLogsExplorer,observabilityOnboarding,observabilityAIAssistantApp,infra,discoverEnhanced]","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":56.999603836},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:40.714+00:00","message":"TaskManager is identified by the Kibana UUID: aefafec7-4939-47a0-b847-14133f8c5305","log":{"level":"INFO","logger":"plugins.taskManager"},"process":{"pid":7,"uptime":57.000237054},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:40.996+00:00","message":"CustomBrandingService registering plugin: customBranding","log":{"level":"INFO","logger":"custom-branding-service"},"process":{"pid":7,"uptime":57.00056706},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:42.005+00:00","message":"Chromium sandbox provides an additional layer of protection, but is not supported for Linux Red Hat Linux 9.7 OS. Automatically setting 'xpack.screenshotting.browser.chromium.disableSandbox: true'.","log":{"level":"WARN","logger":"plugins.screenshotting.config"},"process":{"pid":7,"uptime":57.000839425},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:42.367+00:00","message":"Hashed 'xpack.security.encryptionKey' for this instance: hrAkFgM7+1XQTttrkRAH8sf8Do7CsG2BD16JQfIjx6I=","log":{"level":"INFO","logger":"plugins.security.config"},"process":{"pid":7,"uptime":57.001134352},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:42.367+00:00","message":"Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.","log":{"level":"WARN","logger":"plugins.security.config"},"process":{"pid":7,"uptime":57.001340377},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:42.401+00:00","message":"Hashed 'xpack.security.encryptionKey' for this instance: hrAkFgM7+1XQTttrkRAH8sf8Do7CsG2BD16JQfIjx6I=","log":{"level":"INFO","logger":"plugins.security.config"},"process":{"pid":7,"uptime":57.001557151},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:42.401+00:00","message":"Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.","log":{"level":"WARN","logger":"plugins.security.config"},"process":{"pid":7,"uptime":57.001755851},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:42.440+00:00","message":"Telemetry collection is disabled. For more information on telemetry settings, refer to https://www.elastic.co/docs/reference/kibana/configuration-reference/telemetry-settings.","log":{"level":"INFO","logger":"plugins.telemetry"},"process":{"pid":7,"uptime":57.001982774},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:42.605+00:00","message":"Hashed 'xpack.encryptedSavedObjects.encryptionKey' for this instance: +7xHst18NScX1oUE69enqWazcEWmyW3XnPWm+VPp+Yw=","log":{"level":"INFO","logger":"plugins.encryptedSavedObjects"},"process":{"pid":7,"uptime":57.002316108},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:42.845+00:00","message":"Email Service Error: Email connector not specified.","log":{"level":"INFO","logger":"plugins.notifications"},"process":{"pid":7,"uptime":57.002604211},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:43.930+00:00","message":"CPS feature flag set to undefined","log":{"level":"INFO","logger":"elasticsearch-service"},"process":{"pid":7,"uptime":57.003249437},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:45.489+00:00","message":"using indexes and aliases for persisting alerts","log":{"level":"INFO","logger":"plugins.alerting"},"process":{"pid":7,"uptime":57.003914995},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:47.467+00:00","message":"Registered telemetry collector for agent_builder","log":{"level":"INFO","logger":"plugins.onechat.telemetry"},"process":{"pid":7,"uptime":57.004411602},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:47.467+00:00","message":"Onechat telemetry initialized","log":{"level":"INFO","logger":"plugins.onechat"},"process":{"pid":7,"uptime":57.00465585},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:48.674+00:00","message":"Registering Case Incremental ID Task Manager","log":{"level":"INFO","logger":"plugins.cases.incremental_id_task"},"process":{"pid":7,"uptime":57.011985119},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:49.374+00:00","message":"Hashed 'xpack.reporting.encryptionKey' for this instance: 9ujCqLu4FJjIas553S5JULYvWbUVu+STxitX/SzxyqM=","log":{"level":"INFO","logger":"plugins.reporting.config"},"process":{"pid":7,"uptime":57.012462198},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:53.985+00:00","message":"Registered task successfully [Task: cloud_security_posture-stats_task]","log":{"level":"INFO","logger":"plugins.cloudSecurityPosture"},"process":{"pid":7,"uptime":57.013006092},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:57.196+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-migrations\",\"fieldMap\":{\"name\":{\"type\":\"keyword\",\"required\":true},\"created_at\":{\"type\":\"date\",\"required\":true},\"created_by\":{\"type\":\"keyword\",\"required\":true}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":57.01331293},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:57.196+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-dashboards\",\"fieldMap\":{\"@timestamp\":{\"type\":\"date\",\"required\":false},\"migration_id\":{\"type\":\"keyword\",\"required\":true},\"created_by\":{\"type\":\"keyword\",\"required\":true},\"status\":{\"type\":\"keyword\",\"required\":true},\"translation_result\":{\"type\":\"keyword\",\"required\":true},\"updated_at\":{\"type\":\"date\",\"required\":true},\"updated_by\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard\":{\"type\":\"object\",\"required\":true},\"original_dashboard.id\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.title\":{\"type\":\"text\",\"required\":true,\"fields\":{\"keyword\":{\"type\":\"keyword\"}}},\"original_dashboard.data\":{\"type\":\"text\",\"required\":true},\"original_dashboard.description\":{\"type\":\"text\",\"required\":false},\"original_dashboard.format\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.vendor\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.last_updated\":{\"type\":\"date\",\"required\":true},\"original_dashboard.splunk_properties\":{\"type\":\"object\",\"required\":true},\"original_dashboard.splunk_properties.app\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.splunk_properties.sharing\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.splunk_properties.owner\":{\"type\":\"keyword\",\"required\":true},\"elastic_dashboard\":{\"type\":\"object\",\"required\":false},\"elastic_dashboard.id\":{\"type\":\"keyword\",\"required\":false},\"elastic_dashboard.title\":{\"type\":\"text\",\"required\":true,\"fields\":{\"keyword\":{\"type\":\"keyword\"}}},\"elastic_dashboard.description\":{\"type\":\"text\",\"required\":false},\"elastic_dashboard.data\":{\"type\":\"text\",\"required\":false},\"comments\":{\"type\":\"object\",\"array\":true,\"required\":false},\"comments.message\":{\"type\":\"keyword\",\"required\":true},\"comments.created_at\":{\"type\":\"date\",\"required\":true},\"comments.created_by\":{\"type\":\"keyword\",\"required\":true}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":57.01353267},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:57.196+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-resources\",\"fieldMap\":{\"migration_id\":{\"type\":\"keyword\",\"required\":true},\"type\":{\"type\":\"keyword\",\"required\":true},\"name\":{\"type\":\"keyword\",\"required\":true},\"content\":{\"type\":\"text\",\"required\":false},\"metadata\":{\"type\":\"object\",\"required\":false},\"updated_at\":{\"type\":\"date\",\"required\":false},\"updated_by\":{\"type\":\"keyword\",\"required\":false}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":57.013775806},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:57.290+00:00","message":"Registering endpoint:user-artifact-packager task with timeout of [20m], interval of [60s] and policy update batch size of [25]","log":{"level":"INFO","logger":"plugins.securitySolution.endpoint:user-artifact-packager:1.0.0"},"process":{"pid":7,"uptime":57.014048311},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:01:57.290+00:00","message":"Registering task [endpoint:complete-external-response-actions] with timeout of [5m] and run interval of [60s]","log":{"level":"INFO","logger":"plugins.securitySolution.endpoint:complete-external-response-actions"},"process":{"pid":7,"uptime":57.01427464},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"event":{"action":"kibana_started.elasticsearch.waitTime","category":"database","duration":1363,"type":"connection"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:00.875+00:00","message":"Successfully connected to Elasticsearch after waiting for 1363 milliseconds","log":{"level":"INFO","logger":"elasticsearch-service"},"process":{"pid":7,"uptime":58.348377803},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.271+00:00","message":"Waiting until all Elasticsearch nodes are compatible with Kibana before starting saved objects migrations...","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.745063876},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.272+00:00","message":"Starting saved objects migrations","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.745671988},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.461+00:00","message":"[.kibana] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 60ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.938356776},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.465+00:00","message":"[.kibana_analytics] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 64ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.938899443},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.466+00:00","message":"[.kibana_security_solution] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 71ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.939128341},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.466+00:00","message":"[.kibana_task_manager] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 85ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.939293915},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.466+00:00","message":"[.kibana_usage_counters] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 90ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.93944356},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.466+00:00","message":"[.kibana] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 34ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.939589444},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.466+00:00","message":"[.kibana_search_solution] INIT -> CREATE_INDEX_CHECK_CLUSTER_ROUTING_ALLOCATION. took: 67ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.939740103},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.467+00:00","message":"[.kibana_analytics] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 24ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.939904178},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.467+00:00","message":"[.kibana_task_manager] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 10ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.940078359},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.467+00:00","message":"[.kibana_usage_counters] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 10ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.940429725},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.467+00:00","message":"[.kibana_ingest] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 69ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.940594823},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.467+00:00","message":"[.kibana_alerting_cases] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 87ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.940746476},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.468+00:00","message":"[.kibana_security_solution] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 23ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.940900126},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.468+00:00","message":"[.kibana_search_solution] CREATE_INDEX_CHECK_CLUSTER_ROUTING_ALLOCATION -> CREATE_NEW_TARGET. took: 14ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.941057697},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.468+00:00","message":"[.kibana_ingest] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 14ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.941206825},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.468+00:00","message":"[.kibana_alerting_cases] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 14ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.941349584},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.468+00:00","message":"[.kibana_search_solution] CREATE_NEW_TARGET -> FATAL. took: 34ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":58.9414964},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.469+00:00","message":"Kibana is shutting down","log":{"level":"INFO","logger":"root"},"process":{"pid":7,"uptime":58.942288073},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.471+00:00","message":"Reason: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\nError: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\n at migrationStateActionMachine (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/migrations_state_action_machine.js:99:29)\n at processTicksAndRejections (node:internal/process/task_queues:105:5)\n at /usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/run_v2_migration.js:162:22\n at async Promise.all (index 6)\n at KibanaMigrator.runMigrationsInternal (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/kibana_migrator.js:172:16)\n at SavedObjectsService.start (/usr/share/kibana/node_modules/@kbn/core-saved-objects-server-internal/src/saved_objects_service.js:215:7)\n at Server.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/server.js:437:31)\n at Root.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/root/index.js:67:14)\n at bootstrap (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/bootstrap.js:119:5)\n at Command. (/usr/share/kibana/src/cli/serve/serve.js:236:5)","log":{"level":"FATAL","logger":"root"},"process":{"pid":7,"uptime":58.944236199},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.476+00:00","message":"Stopping all plugins.","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":58.949815676},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.478+00:00","message":"All plugins stopped.","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":58.951077709},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.478+00:00","message":"Stopping all plugins.","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":58.951322652},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.482+00:00","message":"Monitoring stats collection is stopped","log":{"level":"INFO","logger":"plugins.monitoring.monitoring.kibana-monitoring"},"process":{"pid":7,"uptime":58.955572964},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.495+00:00","message":"All plugins stopped.","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":58.969111632},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T15:02:01.932+00:00","message":"Browser executable: /usr/share/kibana/node_modules/@kbn/screenshotting-plugin/chromium/headless_shell-linux_x64/headless_shell","log":{"level":"INFO","logger":"plugins.screenshotting.chromium"},"process":{"pid":7,"uptime":59.405734322},"trace":{"id":"03f678870a12cc1b4287fe57adf294be"},"transaction":{"id":"561e53fbd956bd1c"}} {"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:20:58.762+00:00","message":"Kibana is starting","log":{"level":"INFO","logger":"root"},"process":{"pid":7,"uptime":3.285466911}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:20:58.813+00:00","message":"Kibana process configured with roles: [background_tasks, ui]","log":{"level":"INFO","logger":"node"},"process":{"pid":7,"uptime":3.311858747},"trace":{"id":"8b1822433e4dc7c9ef51393c6d6b1865"},"transaction":{"id":"30800ffd8e348618"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:11.701+00:00","message":"The following plugins are disabled: \"apm,automaticImportVTwo,cloudChat,cloudExperiments,cloudFullStory,dataUsage,developerToolbar,inspectComponent,profilingDataAccess,profiling,securitySolutionServerless,serverless,serverlessObservability,serverlessSearch\".","log":{"level":"INFO","logger":"plugins-service"},"process":{"pid":7,"uptime":16.270906098},"trace":{"id":"8b1822433e4dc7c9ef51393c6d6b1865"},"transaction":{"id":"30800ffd8e348618"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:11.701+00:00","message":"Plugins \"ux\" have been disabled since the following direct or transitive dependencies are missing, disabled, or have incompatible types: [apm].","log":{"level":"INFO","logger":"plugins-service"},"process":{"pid":7,"uptime":16.271229245},"trace":{"id":"8b1822433e4dc7c9ef51393c6d6b1865"},"transaction":{"id":"30800ffd8e348618"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:11.773+00:00","message":"http server running at http://0.0.0.0:5601","log":{"level":"INFO","logger":"http.server.Preboot"},"process":{"pid":7,"uptime":16.271528914},"trace":{"id":"8b1822433e4dc7c9ef51393c6d6b1865"},"transaction":{"id":"30800ffd8e348618"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:11.863+00:00","message":"Setting up [1] plugins: [interactiveSetup]","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":16.362635694},"trace":{"id":"8b1822433e4dc7c9ef51393c6d6b1865"},"transaction":{"id":"30800ffd8e348618"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:11.954+00:00","message":"You should set server.basePath along with server.rewriteBasePath. Starting in 7.0, Kibana will expect that all requests start with server.basePath rather than expecting you to rewrite the requests in your reverse proxy. Set server.rewriteBasePath to false to preserve the current behavior and silence this warning.","log":{"level":"WARN","logger":"config.deprecation"},"process":{"pid":7,"uptime":16.453489838},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:11.955+00:00","message":"TLS is not enabled, or the HTTP protocol is set to HTTP/1. Enabling TLS and using HTTP/2 improves security and performance.","log":{"level":"WARN","logger":"config.deprecation"},"process":{"pid":7,"uptime":16.453845555},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:12.113+00:00","message":"Setting up [189] plugins: [devTools,translations,screenshotMode,usageCollection,telemetryCollectionManager,telemetryCollectionXpack,kibanaUsageCollection,contentManagement,cloud,intercepts,productIntercept,newsfeed,savedObjectsFinder,noDataPage,monitoringCollection,licensing,taskManager,share,sampleDataIngest,productDocBase,reindexService,mapsEms,globalSearch,globalSearchProviders,features,banners,licenseApiGuard,customBranding,ftrApis,fieldsMetadata,fieldFormats,expressions,screenshotting,dataViews,esUiShared,dataSourcesRegistry,customIntegrations,home,searchprofiler,painlessLab,management,spaces,security,telemetry,licenseManagement,indicesMetadata,snapshotRestore,lists,files,encryptedSavedObjects,taskManagerDependencies,entityManager,eventLog,actions,notifications,inference,workflowsExtensions,workflowsExecutionEngine,llmTasks,genAiSettings,dataConnectors,cloudConnect,aiAssistantManagementSelection,advancedSettings,data,savedObjectsTagging,globalSearchBar,savedObjectsManagement,embeddable,uiActionsEnhanced,imageEmbeddable,savedSearch,presentationUtil,metricsDataAccess,logsDataAccess,fileUpload,esql,metricsExperience,ecsDataQualityDashboard,dataViewFieldEditor,console,searchSynonyms,searchQueryRules,searchNotebooks,searchGettingStarted,ingestPipelines,charts,watcher,apmSourcesAccess,apmDataAccess,cloudDataMigration,grokdebugger,cps,unifiedSearch,navigation,visualizations,visTypeXy,visTypeVislib,visTypeVega,visTypeTimelion,visTypeTagcloud,visTypeTable,visTypeMetric,visTypeMarkdown,visTypeHeatmap,inputControlVis,expressionTagcloud,expressionPartitionVis,visTypePie,expressionMetricVis,expressionLegacyMetricVis,expressionHeatmap,expressionGauge,visTypeGauge,eventAnnotation,expressionXY,visTypeTimeseries,lens,maintenanceWindows,alerting,inferenceEndpoint,graph,dataViewManagement,controls,triggersActionsUi,transform,stackConnectors,workflowsManagement,onechat,searchHomepage,observabilityAIAssistant,dashboard,links,dashboardMarkdown,dashboardEnhanced,dashboardAgent,automaticImport,stackAlerts,ruleRegistry,streams,cases,timelines,sessionView,kubernetesSecurity,aiops,agentBuilderPlatform,maps,dataVisualizer,discover,reporting,canvas,ml,searchPlayground,searchInferenceEndpoints,searchAssistant,observabilityAiAssistantManagement,observabilityAgentBuilder,logsShared,upgradeAssistant,elasticAssistant,fleet,osquery,monitoring,logstash,indexManagement,searchIndices,rollup,remoteClusters,crossClusterReplication,indexLifecycleManagement,contentConnectors,enterpriseSearch,datasetQuality,streamsApp,dataQuality,cloudSecurityPosture,cloudDefend,securitySolution,securitySolutionEss,exploratoryView,observability,uptime,slo,synthetics,observabilityLogsExplorer,observabilityOnboarding,observabilityAIAssistantApp,infra,discoverEnhanced]","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":27.239847958},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:12.464+00:00","message":"TaskManager is identified by the Kibana UUID: 813c165d-f020-479c-83c7-cd056c9ef567","log":{"level":"INFO","logger":"plugins.taskManager"},"process":{"pid":7,"uptime":27.240213657},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:12.575+00:00","message":"CustomBrandingService registering plugin: customBranding","log":{"level":"INFO","logger":"custom-branding-service"},"process":{"pid":7,"uptime":27.240446434},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:12.998+00:00","message":"Chromium sandbox provides an additional layer of protection, but is not supported for Linux Red Hat Linux 9.7 OS. Automatically setting 'xpack.screenshotting.browser.chromium.disableSandbox: true'.","log":{"level":"WARN","logger":"plugins.screenshotting.config"},"process":{"pid":7,"uptime":27.240600986},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:13.230+00:00","message":"Hashed 'xpack.security.encryptionKey' for this instance: hrAkFgM7+1XQTttrkRAH8sf8Do7CsG2BD16JQfIjx6I=","log":{"level":"INFO","logger":"plugins.security.config"},"process":{"pid":7,"uptime":27.240784406},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:13.230+00:00","message":"Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.","log":{"level":"WARN","logger":"plugins.security.config"},"process":{"pid":7,"uptime":27.240913874},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:13.258+00:00","message":"Hashed 'xpack.security.encryptionKey' for this instance: hrAkFgM7+1XQTttrkRAH8sf8Do7CsG2BD16JQfIjx6I=","log":{"level":"INFO","logger":"plugins.security.config"},"process":{"pid":7,"uptime":27.241032402},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:13.258+00:00","message":"Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.","log":{"level":"WARN","logger":"plugins.security.config"},"process":{"pid":7,"uptime":27.241152928},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:13.291+00:00","message":"Telemetry collection is disabled. For more information on telemetry settings, refer to https://www.elastic.co/docs/reference/kibana/configuration-reference/telemetry-settings.","log":{"level":"INFO","logger":"plugins.telemetry"},"process":{"pid":7,"uptime":27.24127099},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:13.451+00:00","message":"Hashed 'xpack.encryptedSavedObjects.encryptionKey' for this instance: +7xHst18NScX1oUE69enqWazcEWmyW3XnPWm+VPp+Yw=","log":{"level":"INFO","logger":"plugins.encryptedSavedObjects"},"process":{"pid":7,"uptime":27.241408335},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:13.641+00:00","message":"Email Service Error: Email connector not specified.","log":{"level":"INFO","logger":"plugins.notifications"},"process":{"pid":7,"uptime":27.241548566},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:14.429+00:00","message":"CPS feature flag set to undefined","log":{"level":"INFO","logger":"elasticsearch-service"},"process":{"pid":7,"uptime":27.241805294},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:15.013+00:00","message":"using indexes and aliases for persisting alerts","log":{"level":"INFO","logger":"plugins.alerting"},"process":{"pid":7,"uptime":27.24202961},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:15.861+00:00","message":"Registered telemetry collector for agent_builder","log":{"level":"INFO","logger":"plugins.onechat.telemetry"},"process":{"pid":7,"uptime":27.242188996},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:15.861+00:00","message":"Onechat telemetry initialized","log":{"level":"INFO","logger":"plugins.onechat"},"process":{"pid":7,"uptime":27.242324673},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:16.382+00:00","message":"Registering Case Incremental ID Task Manager","log":{"level":"INFO","logger":"plugins.cases.incremental_id_task"},"process":{"pid":7,"uptime":27.242612795},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:16.811+00:00","message":"Hashed 'xpack.reporting.encryptionKey' for this instance: 9ujCqLu4FJjIas553S5JULYvWbUVu+STxitX/SzxyqM=","log":{"level":"INFO","logger":"plugins.reporting.config"},"process":{"pid":7,"uptime":27.242867389},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:19.230+00:00","message":"Registered task successfully [Task: cloud_security_posture-stats_task]","log":{"level":"INFO","logger":"plugins.cloudSecurityPosture"},"process":{"pid":7,"uptime":27.243113064},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:21.350+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-migrations\",\"fieldMap\":{\"name\":{\"type\":\"keyword\",\"required\":true},\"created_at\":{\"type\":\"date\",\"required\":true},\"created_by\":{\"type\":\"keyword\",\"required\":true}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":27.243288599},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:21.350+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-dashboards\",\"fieldMap\":{\"@timestamp\":{\"type\":\"date\",\"required\":false},\"migration_id\":{\"type\":\"keyword\",\"required\":true},\"created_by\":{\"type\":\"keyword\",\"required\":true},\"status\":{\"type\":\"keyword\",\"required\":true},\"translation_result\":{\"type\":\"keyword\",\"required\":true},\"updated_at\":{\"type\":\"date\",\"required\":true},\"updated_by\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard\":{\"type\":\"object\",\"required\":true},\"original_dashboard.id\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.title\":{\"type\":\"text\",\"required\":true,\"fields\":{\"keyword\":{\"type\":\"keyword\"}}},\"original_dashboard.data\":{\"type\":\"text\",\"required\":true},\"original_dashboard.description\":{\"type\":\"text\",\"required\":false},\"original_dashboard.format\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.vendor\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.last_updated\":{\"type\":\"date\",\"required\":true},\"original_dashboard.splunk_properties\":{\"type\":\"object\",\"required\":true},\"original_dashboard.splunk_properties.app\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.splunk_properties.sharing\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.splunk_properties.owner\":{\"type\":\"keyword\",\"required\":true},\"elastic_dashboard\":{\"type\":\"object\",\"required\":false},\"elastic_dashboard.id\":{\"type\":\"keyword\",\"required\":false},\"elastic_dashboard.title\":{\"type\":\"text\",\"required\":true,\"fields\":{\"keyword\":{\"type\":\"keyword\"}}},\"elastic_dashboard.description\":{\"type\":\"text\",\"required\":false},\"elastic_dashboard.data\":{\"type\":\"text\",\"required\":false},\"comments\":{\"type\":\"object\",\"array\":true,\"required\":false},\"comments.message\":{\"type\":\"keyword\",\"required\":true},\"comments.created_at\":{\"type\":\"date\",\"required\":true},\"comments.created_by\":{\"type\":\"keyword\",\"required\":true}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":27.243450316},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:21.350+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-resources\",\"fieldMap\":{\"migration_id\":{\"type\":\"keyword\",\"required\":true},\"type\":{\"type\":\"keyword\",\"required\":true},\"name\":{\"type\":\"keyword\",\"required\":true},\"content\":{\"type\":\"text\",\"required\":false},\"metadata\":{\"type\":\"object\",\"required\":false},\"updated_at\":{\"type\":\"date\",\"required\":false},\"updated_by\":{\"type\":\"keyword\",\"required\":false}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":27.243598089},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:21.515+00:00","message":"Registering endpoint:user-artifact-packager task with timeout of [20m], interval of [60s] and policy update batch size of [25]","log":{"level":"INFO","logger":"plugins.securitySolution.endpoint:user-artifact-packager:1.0.0"},"process":{"pid":7,"uptime":27.243804553},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:21.516+00:00","message":"Registering task [endpoint:complete-external-response-actions] with timeout of [5m] and run interval of [60s]","log":{"level":"INFO","logger":"plugins.securitySolution.endpoint:complete-external-response-actions"},"process":{"pid":7,"uptime":27.243940912},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:23.533+00:00","message":"Browser executable: /usr/share/kibana/node_modules/@kbn/screenshotting-plugin/chromium/headless_shell-linux_x64/headless_shell","log":{"level":"INFO","logger":"plugins.screenshotting.chromium"},"process":{"pid":7,"uptime":28.032057969},"trace":{"id":"e106a488ec763772b02ca59f48c08f48"},"transaction":{"id":"01971394541207c1"}} {"event":{"action":"kibana_started.elasticsearch.waitTime","category":"database","duration":1854,"type":"connection"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.593+00:00","message":"Successfully connected to Elasticsearch after waiting for 1854 milliseconds","log":{"level":"INFO","logger":"elasticsearch-service"},"process":{"pid":7,"uptime":29.092508073},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.649+00:00","message":"Waiting until all Elasticsearch nodes are compatible with Kibana before starting saved objects migrations...","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.148506653},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.650+00:00","message":"Starting saved objects migrations","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.148872495},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.718+00:00","message":"[.kibana_usage_counters] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 25ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.217164364},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.718+00:00","message":"[.kibana] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 30ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.217472059},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.719+00:00","message":"[.kibana_usage_counters] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 4ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.217629701},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.719+00:00","message":"[.kibana_usage_counters] UPDATE_SOURCE_MAPPINGS_PROPERTIES -> CLEANUP_UNKNOWN_AND_EXCLUDED. took: 1ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.217926964},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.719+00:00","message":"[.kibana_search_solution] INIT -> CREATE_INDEX_CHECK_CLUSTER_ROUTING_ALLOCATION. took: 20ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.218092792},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.719+00:00","message":"[.kibana] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 7ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.218313319},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.720+00:00","message":"[.kibana_analytics] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 35ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.218480401},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.720+00:00","message":"[.kibana_search_solution] CREATE_INDEX_CHECK_CLUSTER_ROUTING_ALLOCATION -> CREATE_NEW_TARGET. took: 5ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.218683757},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.720+00:00","message":"[.kibana_ingest] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 24ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.218892288},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.720+00:00","message":"[.kibana_security_solution] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 38ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.219131173},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.720+00:00","message":"[.kibana_task_manager] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 45ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.219435904},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.721+00:00","message":"[.kibana_alerting_cases] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 36ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.219590956},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.721+00:00","message":"[.kibana_analytics] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 11ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.219853921},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.721+00:00","message":"[.kibana_search_solution] CREATE_NEW_TARGET -> FATAL. took: 14ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":29.220050913},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.721+00:00","message":"Kibana is shutting down","log":{"level":"INFO","logger":"root"},"process":{"pid":7,"uptime":29.220367461},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.723+00:00","message":"Reason: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\nError: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\n at migrationStateActionMachine (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/migrations_state_action_machine.js:99:29)\n at processTicksAndRejections (node:internal/process/task_queues:105:5)\n at /usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/run_v2_migration.js:162:22\n at async Promise.all (index 6)\n at KibanaMigrator.runMigrationsInternal (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/kibana_migrator.js:172:16)\n at SavedObjectsService.start (/usr/share/kibana/node_modules/@kbn/core-saved-objects-server-internal/src/saved_objects_service.js:215:7)\n at Server.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/server.js:437:31)\n at Root.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/root/index.js:67:14)\n at bootstrap (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/bootstrap.js:119:5)\n at Command. (/usr/share/kibana/src/cli/serve/serve.js:236:5)","log":{"level":"FATAL","logger":"root"},"process":{"pid":7,"uptime":29.221600987},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.726+00:00","message":"Stopping all plugins.","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":29.224948539},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.727+00:00","message":"All plugins stopped.","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":29.225637348},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.727+00:00","message":"Stopping all plugins.","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":29.225838363},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.729+00:00","message":"Monitoring stats collection is stopped","log":{"level":"INFO","logger":"plugins.monitoring.monitoring.kibana-monitoring"},"process":{"pid":7,"uptime":29.227908918},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:21:24.735+00:00","message":"All plugins stopped.","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":29.234391522},"trace":{"id":"04dc13e4277eefa98d8b73ebe484980f"},"transaction":{"id":"52677811b993a686"}} {"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:03.989+00:00","message":"Kibana is starting","log":{"level":"INFO","logger":"root"},"process":{"pid":7,"uptime":3.59249565}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:04.039+00:00","message":"Kibana process configured with roles: [background_tasks, ui]","log":{"level":"INFO","logger":"node"},"process":{"pid":7,"uptime":3.619401532},"trace":{"id":"6f75bf2a40c948f2abe365855030ff88"},"transaction":{"id":"ed405fca919db3a3"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:14.006+00:00","message":"The following plugins are disabled: \"apm,automaticImportVTwo,cloudChat,cloudExperiments,cloudFullStory,dataUsage,developerToolbar,inspectComponent,profilingDataAccess,profiling,securitySolutionServerless,serverless,serverlessObservability,serverlessSearch\".","log":{"level":"INFO","logger":"plugins-service"},"process":{"pid":7,"uptime":13.644324221},"trace":{"id":"6f75bf2a40c948f2abe365855030ff88"},"transaction":{"id":"ed405fca919db3a3"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:14.006+00:00","message":"Plugins \"ux\" have been disabled since the following direct or transitive dependencies are missing, disabled, or have incompatible types: [apm].","log":{"level":"INFO","logger":"plugins-service"},"process":{"pid":7,"uptime":13.644601374},"trace":{"id":"6f75bf2a40c948f2abe365855030ff88"},"transaction":{"id":"ed405fca919db3a3"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:14.065+00:00","message":"http server running at http://0.0.0.0:5601","log":{"level":"INFO","logger":"http.server.Preboot"},"process":{"pid":7,"uptime":13.644874634},"trace":{"id":"6f75bf2a40c948f2abe365855030ff88"},"transaction":{"id":"ed405fca919db3a3"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:14.174+00:00","message":"Setting up [1] plugins: [interactiveSetup]","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":13.75495025},"trace":{"id":"6f75bf2a40c948f2abe365855030ff88"},"transaction":{"id":"ed405fca919db3a3"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:14.239+00:00","message":"You should set server.basePath along with server.rewriteBasePath. Starting in 7.0, Kibana will expect that all requests start with server.basePath rather than expecting you to rewrite the requests in your reverse proxy. Set server.rewriteBasePath to false to preserve the current behavior and silence this warning.","log":{"level":"WARN","logger":"config.deprecation"},"process":{"pid":7,"uptime":13.819510432},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:14.239+00:00","message":"TLS is not enabled, or the HTTP protocol is set to HTTP/1. Enabling TLS and using HTTP/2 improves security and performance.","log":{"level":"WARN","logger":"config.deprecation"},"process":{"pid":7,"uptime":13.819905476},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:14.445+00:00","message":"Setting up [189] plugins: [devTools,translations,screenshotMode,usageCollection,telemetryCollectionManager,telemetryCollectionXpack,kibanaUsageCollection,contentManagement,cloud,intercepts,productIntercept,newsfeed,savedObjectsFinder,noDataPage,monitoringCollection,licensing,taskManager,share,sampleDataIngest,productDocBase,reindexService,mapsEms,globalSearch,globalSearchProviders,features,banners,licenseApiGuard,customBranding,ftrApis,fieldsMetadata,fieldFormats,expressions,screenshotting,dataViews,esUiShared,dataSourcesRegistry,customIntegrations,home,searchprofiler,painlessLab,management,spaces,security,telemetry,licenseManagement,indicesMetadata,snapshotRestore,lists,files,encryptedSavedObjects,taskManagerDependencies,entityManager,eventLog,actions,notifications,inference,workflowsExtensions,workflowsExecutionEngine,llmTasks,genAiSettings,dataConnectors,cloudConnect,aiAssistantManagementSelection,advancedSettings,data,savedObjectsTagging,globalSearchBar,savedObjectsManagement,embeddable,uiActionsEnhanced,imageEmbeddable,savedSearch,presentationUtil,metricsDataAccess,logsDataAccess,fileUpload,esql,metricsExperience,ecsDataQualityDashboard,dataViewFieldEditor,console,searchSynonyms,searchQueryRules,searchNotebooks,searchGettingStarted,ingestPipelines,charts,watcher,apmSourcesAccess,apmDataAccess,cloudDataMigration,grokdebugger,cps,unifiedSearch,navigation,visualizations,visTypeXy,visTypeVislib,visTypeVega,visTypeTimelion,visTypeTagcloud,visTypeTable,visTypeMetric,visTypeMarkdown,visTypeHeatmap,inputControlVis,expressionTagcloud,expressionPartitionVis,visTypePie,expressionMetricVis,expressionLegacyMetricVis,expressionHeatmap,expressionGauge,visTypeGauge,eventAnnotation,expressionXY,visTypeTimeseries,lens,maintenanceWindows,alerting,inferenceEndpoint,graph,dataViewManagement,controls,triggersActionsUi,transform,stackConnectors,workflowsManagement,onechat,searchHomepage,observabilityAIAssistant,dashboard,links,dashboardMarkdown,dashboardEnhanced,dashboardAgent,automaticImport,stackAlerts,ruleRegistry,streams,cases,timelines,sessionView,kubernetesSecurity,aiops,agentBuilderPlatform,maps,dataVisualizer,discover,reporting,canvas,ml,searchPlayground,searchInferenceEndpoints,searchAssistant,observabilityAiAssistantManagement,observabilityAgentBuilder,logsShared,upgradeAssistant,elasticAssistant,fleet,osquery,monitoring,logstash,indexManagement,searchIndices,rollup,remoteClusters,crossClusterReplication,indexLifecycleManagement,contentConnectors,enterpriseSearch,datasetQuality,streamsApp,dataQuality,cloudSecurityPosture,cloudDefend,securitySolution,securitySolutionEss,exploratoryView,observability,uptime,slo,synthetics,observabilityLogsExplorer,observabilityOnboarding,observabilityAIAssistantApp,infra,discoverEnhanced]","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":22.956062827},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:14.812+00:00","message":"TaskManager is identified by the Kibana UUID: ff5129e2-73f3-4da9-8ac3-93c040226bf8","log":{"level":"INFO","logger":"plugins.taskManager"},"process":{"pid":7,"uptime":22.95640649},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:14.912+00:00","message":"CustomBrandingService registering plugin: customBranding","log":{"level":"INFO","logger":"custom-branding-service"},"process":{"pid":7,"uptime":22.956648639},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:15.289+00:00","message":"Chromium sandbox provides an additional layer of protection, but is not supported for Linux Red Hat Linux 9.7 OS. Automatically setting 'xpack.screenshotting.browser.chromium.disableSandbox: true'.","log":{"level":"WARN","logger":"plugins.screenshotting.config"},"process":{"pid":7,"uptime":22.956802426},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:15.503+00:00","message":"Hashed 'xpack.security.encryptionKey' for this instance: hrAkFgM7+1XQTttrkRAH8sf8Do7CsG2BD16JQfIjx6I=","log":{"level":"INFO","logger":"plugins.security.config"},"process":{"pid":7,"uptime":22.95698642},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:15.503+00:00","message":"Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.","log":{"level":"WARN","logger":"plugins.security.config"},"process":{"pid":7,"uptime":22.957095541},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:15.543+00:00","message":"Hashed 'xpack.security.encryptionKey' for this instance: hrAkFgM7+1XQTttrkRAH8sf8Do7CsG2BD16JQfIjx6I=","log":{"level":"INFO","logger":"plugins.security.config"},"process":{"pid":7,"uptime":22.957204724},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:15.543+00:00","message":"Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.","log":{"level":"WARN","logger":"plugins.security.config"},"process":{"pid":7,"uptime":22.957312103},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:15.572+00:00","message":"Telemetry collection is disabled. For more information on telemetry settings, refer to https://www.elastic.co/docs/reference/kibana/configuration-reference/telemetry-settings.","log":{"level":"INFO","logger":"plugins.telemetry"},"process":{"pid":7,"uptime":22.957415248},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:15.714+00:00","message":"Hashed 'xpack.encryptedSavedObjects.encryptionKey' for this instance: +7xHst18NScX1oUE69enqWazcEWmyW3XnPWm+VPp+Yw=","log":{"level":"INFO","logger":"plugins.encryptedSavedObjects"},"process":{"pid":7,"uptime":22.957535065},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:15.872+00:00","message":"Email Service Error: Email connector not specified.","log":{"level":"INFO","logger":"plugins.notifications"},"process":{"pid":7,"uptime":22.957657782},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:16.435+00:00","message":"CPS feature flag set to undefined","log":{"level":"INFO","logger":"elasticsearch-service"},"process":{"pid":7,"uptime":22.957872666},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:16.925+00:00","message":"using indexes and aliases for persisting alerts","log":{"level":"INFO","logger":"plugins.alerting"},"process":{"pid":7,"uptime":22.960714004},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:17.674+00:00","message":"Registered telemetry collector for agent_builder","log":{"level":"INFO","logger":"plugins.onechat.telemetry"},"process":{"pid":7,"uptime":22.961068859},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:17.674+00:00","message":"Onechat telemetry initialized","log":{"level":"INFO","logger":"plugins.onechat"},"process":{"pid":7,"uptime":22.961172366},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:18.126+00:00","message":"Registering Case Incremental ID Task Manager","log":{"level":"INFO","logger":"plugins.cases.incremental_id_task"},"process":{"pid":7,"uptime":22.961456955},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:18.405+00:00","message":"Hashed 'xpack.reporting.encryptionKey' for this instance: 9ujCqLu4FJjIas553S5JULYvWbUVu+STxitX/SzxyqM=","log":{"level":"INFO","logger":"plugins.reporting.config"},"process":{"pid":7,"uptime":22.961579146},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:20.287+00:00","message":"Registered task successfully [Task: cloud_security_posture-stats_task]","log":{"level":"INFO","logger":"plugins.cloudSecurityPosture"},"process":{"pid":7,"uptime":22.961766462},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:22.065+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-migrations\",\"fieldMap\":{\"name\":{\"type\":\"keyword\",\"required\":true},\"created_at\":{\"type\":\"date\",\"required\":true},\"created_by\":{\"type\":\"keyword\",\"required\":true}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":22.961869598},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:22.065+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-dashboards\",\"fieldMap\":{\"@timestamp\":{\"type\":\"date\",\"required\":false},\"migration_id\":{\"type\":\"keyword\",\"required\":true},\"created_by\":{\"type\":\"keyword\",\"required\":true},\"status\":{\"type\":\"keyword\",\"required\":true},\"translation_result\":{\"type\":\"keyword\",\"required\":true},\"updated_at\":{\"type\":\"date\",\"required\":true},\"updated_by\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard\":{\"type\":\"object\",\"required\":true},\"original_dashboard.id\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.title\":{\"type\":\"text\",\"required\":true,\"fields\":{\"keyword\":{\"type\":\"keyword\"}}},\"original_dashboard.data\":{\"type\":\"text\",\"required\":true},\"original_dashboard.description\":{\"type\":\"text\",\"required\":false},\"original_dashboard.format\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.vendor\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.last_updated\":{\"type\":\"date\",\"required\":true},\"original_dashboard.splunk_properties\":{\"type\":\"object\",\"required\":true},\"original_dashboard.splunk_properties.app\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.splunk_properties.sharing\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.splunk_properties.owner\":{\"type\":\"keyword\",\"required\":true},\"elastic_dashboard\":{\"type\":\"object\",\"required\":false},\"elastic_dashboard.id\":{\"type\":\"keyword\",\"required\":false},\"elastic_dashboard.title\":{\"type\":\"text\",\"required\":true,\"fields\":{\"keyword\":{\"type\":\"keyword\"}}},\"elastic_dashboard.description\":{\"type\":\"text\",\"required\":false},\"elastic_dashboard.data\":{\"type\":\"text\",\"required\":false},\"comments\":{\"type\":\"object\",\"array\":true,\"required\":false},\"comments.message\":{\"type\":\"keyword\",\"required\":true},\"comments.created_at\":{\"type\":\"date\",\"required\":true},\"comments.created_by\":{\"type\":\"keyword\",\"required\":true}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":22.961981559},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:22.065+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-resources\",\"fieldMap\":{\"migration_id\":{\"type\":\"keyword\",\"required\":true},\"type\":{\"type\":\"keyword\",\"required\":true},\"name\":{\"type\":\"keyword\",\"required\":true},\"content\":{\"type\":\"text\",\"required\":false},\"metadata\":{\"type\":\"object\",\"required\":false},\"updated_at\":{\"type\":\"date\",\"required\":false},\"updated_by\":{\"type\":\"keyword\",\"required\":false}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":22.962074032},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:22.144+00:00","message":"Registering endpoint:user-artifact-packager task with timeout of [20m], interval of [60s] and policy update batch size of [25]","log":{"level":"INFO","logger":"plugins.securitySolution.endpoint:user-artifact-packager:1.0.0"},"process":{"pid":7,"uptime":22.96218359},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:22.144+00:00","message":"Registering task [endpoint:complete-external-response-actions] with timeout of [5m] and run interval of [60s]","log":{"level":"INFO","logger":"plugins.securitySolution.endpoint:complete-external-response-actions"},"process":{"pid":7,"uptime":22.962272513},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"event":{"action":"kibana_started.elasticsearch.waitTime","category":"database","duration":23,"type":"connection"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.396+00:00","message":"Successfully connected to Elasticsearch after waiting for 23 milliseconds","log":{"level":"INFO","logger":"elasticsearch-service"},"process":{"pid":7,"uptime":22.976539513},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.456+00:00","message":"Waiting until all Elasticsearch nodes are compatible with Kibana before starting saved objects migrations...","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.036610397},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.457+00:00","message":"Starting saved objects migrations","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.036970152},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.552+00:00","message":"[.kibana_usage_counters] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 21ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.133082306},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.553+00:00","message":"[.kibana] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 27ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.133331382},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.553+00:00","message":"[.kibana_usage_counters] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 9ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.133479644},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.553+00:00","message":"[.kibana_usage_counters] UPDATE_SOURCE_MAPPINGS_PROPERTIES -> CLEANUP_UNKNOWN_AND_EXCLUDED. took: 0ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.133628958},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.554+00:00","message":"[.kibana] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 7ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.133780475},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.554+00:00","message":"[.kibana_task_manager] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 37ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.133930522},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.554+00:00","message":"[.kibana_task_manager] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 6ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.134093291},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.554+00:00","message":"[.kibana_security_solution] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 41ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.134238631},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.554+00:00","message":"[.kibana_alerting_cases] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 40ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.134380237},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.554+00:00","message":"[.kibana_search_solution] INIT -> CREATE_INDEX_CHECK_CLUSTER_ROUTING_ALLOCATION. took: 39ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.134570887},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.554+00:00","message":"[.kibana_analytics] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 48ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.134713397},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.555+00:00","message":"[.kibana_task_manager] UPDATE_SOURCE_MAPPINGS_PROPERTIES -> CLEANUP_UNKNOWN_AND_EXCLUDED. took: 10ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.134860022},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.555+00:00","message":"[.kibana_security_solution] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 8ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.135027672},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.555+00:00","message":"[.kibana_alerting_cases] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 7ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.135190195},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.555+00:00","message":"[.kibana_search_solution] CREATE_INDEX_CHECK_CLUSTER_ROUTING_ALLOCATION -> CREATE_NEW_TARGET. took: 8ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.135357677},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.555+00:00","message":"[.kibana_ingest] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 46ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.135504616},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.555+00:00","message":"[.kibana_analytics] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 10ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.135680302},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.556+00:00","message":"[.kibana] UPDATE_SOURCE_MAPPINGS_PROPERTIES -> CLEANUP_UNKNOWN_AND_EXCLUDED. took: 32ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.135831284},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.556+00:00","message":"[.kibana_ingest] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 6ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.136002092},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.556+00:00","message":"[.kibana_security_solution] UPDATE_SOURCE_MAPPINGS_PROPERTIES -> CLEANUP_UNKNOWN_AND_EXCLUDED. took: 14ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.136136193},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.556+00:00","message":"[.kibana_search_solution] CREATE_NEW_TARGET -> FATAL. took: 15ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":23.136267094},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.556+00:00","message":"Kibana is shutting down","log":{"level":"INFO","logger":"root"},"process":{"pid":7,"uptime":23.136612625},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.558+00:00","message":"Reason: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\nError: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\n at migrationStateActionMachine (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/migrations_state_action_machine.js:99:29)\n at processTicksAndRejections (node:internal/process/task_queues:105:5)\n at /usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/run_v2_migration.js:162:22\n at async Promise.all (index 6)\n at KibanaMigrator.runMigrationsInternal (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/kibana_migrator.js:172:16)\n at SavedObjectsService.start (/usr/share/kibana/node_modules/@kbn/core-saved-objects-server-internal/src/saved_objects_service.js:215:7)\n at Server.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/server.js:437:31)\n at Root.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/root/index.js:67:14)\n at bootstrap (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/bootstrap.js:119:5)\n at Command. (/usr/share/kibana/src/cli/serve/serve.js:236:5)","log":{"level":"FATAL","logger":"root"},"process":{"pid":7,"uptime":23.13786292},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.561+00:00","message":"Stopping all plugins.","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":23.141812384},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.562+00:00","message":"All plugins stopped.","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":23.142593953},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.562+00:00","message":"Stopping all plugins.","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":23.142728795},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.564+00:00","message":"Monitoring stats collection is stopped","log":{"level":"INFO","logger":"plugins.monitoring.monitoring.kibana-monitoring"},"process":{"pid":7,"uptime":23.144648961},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:23.570+00:00","message":"All plugins stopped.","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":23.150735493},"trace":{"id":"fdef126dcd9ff8b6fee7e7156c001d9f"},"transaction":{"id":"0380b03d6b6709ff"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:23:24.293+00:00","message":"Browser executable: /usr/share/kibana/node_modules/@kbn/screenshotting-plugin/chromium/headless_shell-linux_x64/headless_shell","log":{"level":"INFO","logger":"plugins.screenshotting.chromium"},"process":{"pid":7,"uptime":23.873090681},"trace":{"id":"89d83ff682e3e2c599c4ea6d22470aff"},"transaction":{"id":"460471e8776cbf7e"}} {"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:24.771+00:00","message":"Kibana is starting","log":{"level":"INFO","logger":"root"},"process":{"pid":7,"uptime":3.198216298}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:24.814+00:00","message":"Kibana process configured with roles: [background_tasks, ui]","log":{"level":"INFO","logger":"node"},"process":{"pid":7,"uptime":3.222177927},"trace":{"id":"8de16302722bbec10bcb31063d26e833"},"transaction":{"id":"180bb8b6eb5eab6b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:33.877+00:00","message":"The following plugins are disabled: \"apm,automaticImportVTwo,cloudChat,cloudExperiments,cloudFullStory,dataUsage,developerToolbar,inspectComponent,profilingDataAccess,profiling,securitySolutionServerless,serverless,serverlessObservability,serverlessSearch\".","log":{"level":"INFO","logger":"plugins-service"},"process":{"pid":7,"uptime":12.335441403},"trace":{"id":"8de16302722bbec10bcb31063d26e833"},"transaction":{"id":"180bb8b6eb5eab6b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:33.877+00:00","message":"Plugins \"ux\" have been disabled since the following direct or transitive dependencies are missing, disabled, or have incompatible types: [apm].","log":{"level":"INFO","logger":"plugins-service"},"process":{"pid":7,"uptime":12.335724455},"trace":{"id":"8de16302722bbec10bcb31063d26e833"},"transaction":{"id":"180bb8b6eb5eab6b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:33.928+00:00","message":"http server running at http://0.0.0.0:5601","log":{"level":"INFO","logger":"http.server.Preboot"},"process":{"pid":7,"uptime":12.336000497},"trace":{"id":"8de16302722bbec10bcb31063d26e833"},"transaction":{"id":"180bb8b6eb5eab6b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:34.018+00:00","message":"Setting up [1] plugins: [interactiveSetup]","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":12.42635804},"trace":{"id":"8de16302722bbec10bcb31063d26e833"},"transaction":{"id":"180bb8b6eb5eab6b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:34.085+00:00","message":"You should set server.basePath along with server.rewriteBasePath. Starting in 7.0, Kibana will expect that all requests start with server.basePath rather than expecting you to rewrite the requests in your reverse proxy. Set server.rewriteBasePath to false to preserve the current behavior and silence this warning.","log":{"level":"WARN","logger":"config.deprecation"},"process":{"pid":7,"uptime":12.493434371},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:34.086+00:00","message":"TLS is not enabled, or the HTTP protocol is set to HTTP/1. Enabling TLS and using HTTP/2 improves security and performance.","log":{"level":"WARN","logger":"config.deprecation"},"process":{"pid":7,"uptime":12.493806555},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:34.210+00:00","message":"Setting up [189] plugins: [devTools,translations,screenshotMode,usageCollection,telemetryCollectionManager,telemetryCollectionXpack,kibanaUsageCollection,contentManagement,cloud,intercepts,productIntercept,newsfeed,savedObjectsFinder,noDataPage,monitoringCollection,licensing,taskManager,share,sampleDataIngest,productDocBase,reindexService,mapsEms,globalSearch,globalSearchProviders,features,banners,licenseApiGuard,customBranding,ftrApis,fieldsMetadata,fieldFormats,expressions,screenshotting,dataViews,esUiShared,dataSourcesRegistry,customIntegrations,home,searchprofiler,painlessLab,management,spaces,security,telemetry,licenseManagement,indicesMetadata,snapshotRestore,lists,files,encryptedSavedObjects,taskManagerDependencies,entityManager,eventLog,actions,notifications,inference,workflowsExtensions,workflowsExecutionEngine,llmTasks,genAiSettings,dataConnectors,cloudConnect,aiAssistantManagementSelection,advancedSettings,data,savedObjectsTagging,globalSearchBar,savedObjectsManagement,embeddable,uiActionsEnhanced,imageEmbeddable,savedSearch,presentationUtil,metricsDataAccess,logsDataAccess,fileUpload,esql,metricsExperience,ecsDataQualityDashboard,dataViewFieldEditor,console,searchSynonyms,searchQueryRules,searchNotebooks,searchGettingStarted,ingestPipelines,charts,watcher,apmSourcesAccess,apmDataAccess,cloudDataMigration,grokdebugger,cps,unifiedSearch,navigation,visualizations,visTypeXy,visTypeVislib,visTypeVega,visTypeTimelion,visTypeTagcloud,visTypeTable,visTypeMetric,visTypeMarkdown,visTypeHeatmap,inputControlVis,expressionTagcloud,expressionPartitionVis,visTypePie,expressionMetricVis,expressionLegacyMetricVis,expressionHeatmap,expressionGauge,visTypeGauge,eventAnnotation,expressionXY,visTypeTimeseries,lens,maintenanceWindows,alerting,inferenceEndpoint,graph,dataViewManagement,controls,triggersActionsUi,transform,stackConnectors,workflowsManagement,onechat,searchHomepage,observabilityAIAssistant,dashboard,links,dashboardMarkdown,dashboardEnhanced,dashboardAgent,automaticImport,stackAlerts,ruleRegistry,streams,cases,timelines,sessionView,kubernetesSecurity,aiops,agentBuilderPlatform,maps,dataVisualizer,discover,reporting,canvas,ml,searchPlayground,searchInferenceEndpoints,searchAssistant,observabilityAiAssistantManagement,observabilityAgentBuilder,logsShared,upgradeAssistant,elasticAssistant,fleet,osquery,monitoring,logstash,indexManagement,searchIndices,rollup,remoteClusters,crossClusterReplication,indexLifecycleManagement,contentConnectors,enterpriseSearch,datasetQuality,streamsApp,dataQuality,cloudSecurityPosture,cloudDefend,securitySolution,securitySolutionEss,exploratoryView,observability,uptime,slo,synthetics,observabilityLogsExplorer,observabilityOnboarding,observabilityAIAssistantApp,infra,discoverEnhanced]","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":21.553049156},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:34.521+00:00","message":"TaskManager is identified by the Kibana UUID: ff5129e2-73f3-4da9-8ac3-93c040226bf8","log":{"level":"INFO","logger":"plugins.taskManager"},"process":{"pid":7,"uptime":21.553408286},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:34.609+00:00","message":"CustomBrandingService registering plugin: customBranding","log":{"level":"INFO","logger":"custom-branding-service"},"process":{"pid":7,"uptime":21.553616949},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:34.994+00:00","message":"Chromium sandbox provides an additional layer of protection, but is not supported for Linux Red Hat Linux 9.7 OS. Automatically setting 'xpack.screenshotting.browser.chromium.disableSandbox: true'.","log":{"level":"WARN","logger":"plugins.screenshotting.config"},"process":{"pid":7,"uptime":21.553756827},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:35.202+00:00","message":"Hashed 'xpack.security.encryptionKey' for this instance: hrAkFgM7+1XQTttrkRAH8sf8Do7CsG2BD16JQfIjx6I=","log":{"level":"INFO","logger":"plugins.security.config"},"process":{"pid":7,"uptime":21.553897413},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:35.202+00:00","message":"Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.","log":{"level":"WARN","logger":"plugins.security.config"},"process":{"pid":7,"uptime":21.554060826},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:35.225+00:00","message":"Hashed 'xpack.security.encryptionKey' for this instance: hrAkFgM7+1XQTttrkRAH8sf8Do7CsG2BD16JQfIjx6I=","log":{"level":"INFO","logger":"plugins.security.config"},"process":{"pid":7,"uptime":21.554164043},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:35.225+00:00","message":"Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.","log":{"level":"WARN","logger":"plugins.security.config"},"process":{"pid":7,"uptime":21.554265294},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:35.253+00:00","message":"Telemetry collection is disabled. For more information on telemetry settings, refer to https://www.elastic.co/docs/reference/kibana/configuration-reference/telemetry-settings.","log":{"level":"INFO","logger":"plugins.telemetry"},"process":{"pid":7,"uptime":21.554375696},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:35.396+00:00","message":"Hashed 'xpack.encryptedSavedObjects.encryptionKey' for this instance: +7xHst18NScX1oUE69enqWazcEWmyW3XnPWm+VPp+Yw=","log":{"level":"INFO","logger":"plugins.encryptedSavedObjects"},"process":{"pid":7,"uptime":21.556575734},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:35.628+00:00","message":"Email Service Error: Email connector not specified.","log":{"level":"INFO","logger":"plugins.notifications"},"process":{"pid":7,"uptime":21.55678668},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:36.360+00:00","message":"CPS feature flag set to undefined","log":{"level":"INFO","logger":"elasticsearch-service"},"process":{"pid":7,"uptime":21.557021473},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:36.838+00:00","message":"using indexes and aliases for persisting alerts","log":{"level":"INFO","logger":"plugins.alerting"},"process":{"pid":7,"uptime":21.55722822},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:37.471+00:00","message":"Registered telemetry collector for agent_builder","log":{"level":"INFO","logger":"plugins.onechat.telemetry"},"process":{"pid":7,"uptime":21.557379072},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:37.471+00:00","message":"Onechat telemetry initialized","log":{"level":"INFO","logger":"plugins.onechat"},"process":{"pid":7,"uptime":21.557472702},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:37.934+00:00","message":"Registering Case Incremental ID Task Manager","log":{"level":"INFO","logger":"plugins.cases.incremental_id_task"},"process":{"pid":7,"uptime":21.55774493},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:38.254+00:00","message":"Hashed 'xpack.reporting.encryptionKey' for this instance: 9ujCqLu4FJjIas553S5JULYvWbUVu+STxitX/SzxyqM=","log":{"level":"INFO","logger":"plugins.reporting.config"},"process":{"pid":7,"uptime":21.557869814},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:40.255+00:00","message":"Registered task successfully [Task: cloud_security_posture-stats_task]","log":{"level":"INFO","logger":"plugins.cloudSecurityPosture"},"process":{"pid":7,"uptime":21.558062691},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:42.114+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-migrations\",\"fieldMap\":{\"name\":{\"type\":\"keyword\",\"required\":true},\"created_at\":{\"type\":\"date\",\"required\":true},\"created_by\":{\"type\":\"keyword\",\"required\":true}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":21.558168421},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:42.114+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-dashboards\",\"fieldMap\":{\"@timestamp\":{\"type\":\"date\",\"required\":false},\"migration_id\":{\"type\":\"keyword\",\"required\":true},\"created_by\":{\"type\":\"keyword\",\"required\":true},\"status\":{\"type\":\"keyword\",\"required\":true},\"translation_result\":{\"type\":\"keyword\",\"required\":true},\"updated_at\":{\"type\":\"date\",\"required\":true},\"updated_by\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard\":{\"type\":\"object\",\"required\":true},\"original_dashboard.id\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.title\":{\"type\":\"text\",\"required\":true,\"fields\":{\"keyword\":{\"type\":\"keyword\"}}},\"original_dashboard.data\":{\"type\":\"text\",\"required\":true},\"original_dashboard.description\":{\"type\":\"text\",\"required\":false},\"original_dashboard.format\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.vendor\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.last_updated\":{\"type\":\"date\",\"required\":true},\"original_dashboard.splunk_properties\":{\"type\":\"object\",\"required\":true},\"original_dashboard.splunk_properties.app\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.splunk_properties.sharing\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.splunk_properties.owner\":{\"type\":\"keyword\",\"required\":true},\"elastic_dashboard\":{\"type\":\"object\",\"required\":false},\"elastic_dashboard.id\":{\"type\":\"keyword\",\"required\":false},\"elastic_dashboard.title\":{\"type\":\"text\",\"required\":true,\"fields\":{\"keyword\":{\"type\":\"keyword\"}}},\"elastic_dashboard.description\":{\"type\":\"text\",\"required\":false},\"elastic_dashboard.data\":{\"type\":\"text\",\"required\":false},\"comments\":{\"type\":\"object\",\"array\":true,\"required\":false},\"comments.message\":{\"type\":\"keyword\",\"required\":true},\"comments.created_at\":{\"type\":\"date\",\"required\":true},\"comments.created_by\":{\"type\":\"keyword\",\"required\":true}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":21.558289482},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:42.115+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-resources\",\"fieldMap\":{\"migration_id\":{\"type\":\"keyword\",\"required\":true},\"type\":{\"type\":\"keyword\",\"required\":true},\"name\":{\"type\":\"keyword\",\"required\":true},\"content\":{\"type\":\"text\",\"required\":false},\"metadata\":{\"type\":\"object\",\"required\":false},\"updated_at\":{\"type\":\"date\",\"required\":false},\"updated_by\":{\"type\":\"keyword\",\"required\":false}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":21.558394818},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:42.175+00:00","message":"Registering endpoint:user-artifact-packager task with timeout of [20m], interval of [60s] and policy update batch size of [25]","log":{"level":"INFO","logger":"plugins.securitySolution.endpoint:user-artifact-packager:1.0.0"},"process":{"pid":7,"uptime":21.558517356},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:42.175+00:00","message":"Registering task [endpoint:complete-external-response-actions] with timeout of [5m] and run interval of [60s]","log":{"level":"INFO","logger":"plugins.securitySolution.endpoint:complete-external-response-actions"},"process":{"pid":7,"uptime":21.558609615},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"event":{"action":"kibana_started.elasticsearch.waitTime","category":"database","duration":18,"type":"connection"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.161+00:00","message":"Successfully connected to Elasticsearch after waiting for 18 milliseconds","log":{"level":"INFO","logger":"elasticsearch-service"},"process":{"pid":7,"uptime":21.569025078},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.246+00:00","message":"Waiting until all Elasticsearch nodes are compatible with Kibana before starting saved objects migrations...","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.653674303},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.246+00:00","message":"Starting saved objects migrations","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.654000952},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.338+00:00","message":"[.kibana_usage_counters] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 26ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.745841743},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.338+00:00","message":"[.kibana_task_manager] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 28ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.746071323},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.338+00:00","message":"[.kibana_alerting_cases] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 24ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.746197982},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.338+00:00","message":"[.kibana] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 36ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.746297888},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.339+00:00","message":"[.kibana_search_solution] INIT -> CREATE_INDEX_CHECK_CLUSTER_ROUTING_ALLOCATION. took: 27ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.746466687},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.339+00:00","message":"[.kibana_analytics] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 35ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.746570269},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.339+00:00","message":"[.kibana_task_manager] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 11ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.746660613},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.339+00:00","message":"[.kibana_alerting_cases] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 11ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.746746568},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.339+00:00","message":"[.kibana] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 11ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.746883353},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.339+00:00","message":"[.kibana_ingest] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 37ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.746977186},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.339+00:00","message":"[.kibana_search_solution] CREATE_INDEX_CHECK_CLUSTER_ROUTING_ALLOCATION -> CREATE_NEW_TARGET. took: 13ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.747062806},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.339+00:00","message":"[.kibana_security_solution] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 46ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.747168178},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.339+00:00","message":"[.kibana_usage_counters] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 27ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.747253512},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.340+00:00","message":"[.kibana_usage_counters] UPDATE_SOURCE_MAPPINGS_PROPERTIES -> CLEANUP_UNKNOWN_AND_EXCLUDED. took: 0ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.747346594},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.340+00:00","message":"[.kibana_ingest] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 8ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.747451161},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.340+00:00","message":"[.kibana_analytics] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 19ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.747532702},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.340+00:00","message":"[.kibana_security_solution] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 7ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.747642499},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.340+00:00","message":"[.kibana_search_solution] CREATE_NEW_TARGET -> FATAL. took: 26ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":21.747728231},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.340+00:00","message":"Kibana is shutting down","log":{"level":"INFO","logger":"root"},"process":{"pid":7,"uptime":21.748013245},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.341+00:00","message":"Reason: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\nError: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\n at migrationStateActionMachine (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/migrations_state_action_machine.js:99:29)\n at processTicksAndRejections (node:internal/process/task_queues:105:5)\n at /usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/run_v2_migration.js:162:22\n at async Promise.all (index 6)\n at KibanaMigrator.runMigrationsInternal (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/kibana_migrator.js:172:16)\n at SavedObjectsService.start (/usr/share/kibana/node_modules/@kbn/core-saved-objects-server-internal/src/saved_objects_service.js:215:7)\n at Server.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/server.js:437:31)\n at Root.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/root/index.js:67:14)\n at bootstrap (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/bootstrap.js:119:5)\n at Command. (/usr/share/kibana/src/cli/serve/serve.js:236:5)","log":{"level":"FATAL","logger":"root"},"process":{"pid":7,"uptime":21.749253875},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.345+00:00","message":"Stopping all plugins.","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":21.752680691},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.345+00:00","message":"All plugins stopped.","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":21.75339647},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.346+00:00","message":"Stopping all plugins.","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":21.753513495},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.348+00:00","message":"Monitoring stats collection is stopped","log":{"level":"INFO","logger":"plugins.monitoring.monitoring.kibana-monitoring"},"process":{"pid":7,"uptime":21.756556793},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.355+00:00","message":"All plugins stopped.","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":21.763133652},"trace":{"id":"21d710e63ab4de42d122c30619d20455"},"transaction":{"id":"2d27b06ea30ea7f6"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T17:39:43.982+00:00","message":"Browser executable: /usr/share/kibana/node_modules/@kbn/screenshotting-plugin/chromium/headless_shell-linux_x64/headless_shell","log":{"level":"INFO","logger":"plugins.screenshotting.chromium"},"process":{"pid":7,"uptime":22.389557852},"trace":{"id":"e7fe3f1949fa1309a6bd850625157db2"},"transaction":{"id":"d9a854687d1944d1"}} {"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:22.642+00:00","message":"Kibana is starting","log":{"level":"INFO","logger":"root"},"process":{"pid":7,"uptime":2.846149106}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:22.683+00:00","message":"Kibana process configured with roles: [background_tasks, ui]","log":{"level":"INFO","logger":"node"},"process":{"pid":7,"uptime":2.867122861},"trace":{"id":"5385c556b274012bc7bf79a4ed64fb98"},"transaction":{"id":"15748fdd55c6f71a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:32.377+00:00","message":"The following plugins are disabled: \"apm,automaticImportVTwo,cloudChat,cloudExperiments,cloudFullStory,dataUsage,developerToolbar,inspectComponent,profilingDataAccess,profiling,securitySolutionServerless,serverless,serverlessObservability,serverlessSearch\".","log":{"level":"INFO","logger":"plugins-service"},"process":{"pid":7,"uptime":12.612084502},"trace":{"id":"5385c556b274012bc7bf79a4ed64fb98"},"transaction":{"id":"15748fdd55c6f71a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:32.377+00:00","message":"Plugins \"ux\" have been disabled since the following direct or transitive dependencies are missing, disabled, or have incompatible types: [apm].","log":{"level":"INFO","logger":"plugins-service"},"process":{"pid":7,"uptime":12.612419784},"trace":{"id":"5385c556b274012bc7bf79a4ed64fb98"},"transaction":{"id":"15748fdd55c6f71a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:32.429+00:00","message":"http server running at http://0.0.0.0:5601","log":{"level":"INFO","logger":"http.server.Preboot"},"process":{"pid":7,"uptime":12.612692314},"trace":{"id":"5385c556b274012bc7bf79a4ed64fb98"},"transaction":{"id":"15748fdd55c6f71a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:32.491+00:00","message":"Setting up [1] plugins: [interactiveSetup]","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":12.675201057},"trace":{"id":"5385c556b274012bc7bf79a4ed64fb98"},"transaction":{"id":"15748fdd55c6f71a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:32.530+00:00","message":"You should set server.basePath along with server.rewriteBasePath. Starting in 7.0, Kibana will expect that all requests start with server.basePath rather than expecting you to rewrite the requests in your reverse proxy. Set server.rewriteBasePath to false to preserve the current behavior and silence this warning.","log":{"level":"WARN","logger":"config.deprecation"},"process":{"pid":7,"uptime":12.714152862},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:32.530+00:00","message":"TLS is not enabled, or the HTTP protocol is set to HTTP/1. Enabling TLS and using HTTP/2 improves security and performance.","log":{"level":"WARN","logger":"config.deprecation"},"process":{"pid":7,"uptime":12.714584986},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:32.651+00:00","message":"Setting up [189] plugins: [devTools,translations,screenshotMode,usageCollection,telemetryCollectionManager,telemetryCollectionXpack,kibanaUsageCollection,contentManagement,cloud,intercepts,productIntercept,newsfeed,savedObjectsFinder,noDataPage,monitoringCollection,licensing,taskManager,share,sampleDataIngest,productDocBase,reindexService,mapsEms,globalSearch,globalSearchProviders,features,banners,licenseApiGuard,customBranding,ftrApis,fieldsMetadata,fieldFormats,expressions,screenshotting,dataViews,esUiShared,dataSourcesRegistry,customIntegrations,home,searchprofiler,painlessLab,management,spaces,security,telemetry,licenseManagement,indicesMetadata,snapshotRestore,lists,files,encryptedSavedObjects,taskManagerDependencies,entityManager,eventLog,actions,notifications,inference,workflowsExtensions,workflowsExecutionEngine,llmTasks,genAiSettings,dataConnectors,cloudConnect,aiAssistantManagementSelection,advancedSettings,data,savedObjectsTagging,globalSearchBar,savedObjectsManagement,embeddable,uiActionsEnhanced,imageEmbeddable,savedSearch,presentationUtil,metricsDataAccess,logsDataAccess,fileUpload,esql,metricsExperience,ecsDataQualityDashboard,dataViewFieldEditor,console,searchSynonyms,searchQueryRules,searchNotebooks,searchGettingStarted,ingestPipelines,charts,watcher,apmSourcesAccess,apmDataAccess,cloudDataMigration,grokdebugger,cps,unifiedSearch,navigation,visualizations,visTypeXy,visTypeVislib,visTypeVega,visTypeTimelion,visTypeTagcloud,visTypeTable,visTypeMetric,visTypeMarkdown,visTypeHeatmap,inputControlVis,expressionTagcloud,expressionPartitionVis,visTypePie,expressionMetricVis,expressionLegacyMetricVis,expressionHeatmap,expressionGauge,visTypeGauge,eventAnnotation,expressionXY,visTypeTimeseries,lens,maintenanceWindows,alerting,inferenceEndpoint,graph,dataViewManagement,controls,triggersActionsUi,transform,stackConnectors,workflowsManagement,onechat,searchHomepage,observabilityAIAssistant,dashboard,links,dashboardMarkdown,dashboardEnhanced,dashboardAgent,automaticImport,stackAlerts,ruleRegistry,streams,cases,timelines,sessionView,kubernetesSecurity,aiops,agentBuilderPlatform,maps,dataVisualizer,discover,reporting,canvas,ml,searchPlayground,searchInferenceEndpoints,searchAssistant,observabilityAiAssistantManagement,observabilityAgentBuilder,logsShared,upgradeAssistant,elasticAssistant,fleet,osquery,monitoring,logstash,indexManagement,searchIndices,rollup,remoteClusters,crossClusterReplication,indexLifecycleManagement,contentConnectors,enterpriseSearch,datasetQuality,streamsApp,dataQuality,cloudSecurityPosture,cloudDefend,securitySolution,securitySolutionEss,exploratoryView,observability,uptime,slo,synthetics,observabilityLogsExplorer,observabilityOnboarding,observabilityAIAssistantApp,infra,discoverEnhanced]","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":22.096751055},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:32.962+00:00","message":"TaskManager is identified by the Kibana UUID: ff5129e2-73f3-4da9-8ac3-93c040226bf8","log":{"level":"INFO","logger":"plugins.taskManager"},"process":{"pid":7,"uptime":22.097106124},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:33.049+00:00","message":"CustomBrandingService registering plugin: customBranding","log":{"level":"INFO","logger":"custom-branding-service"},"process":{"pid":7,"uptime":22.097353175},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:33.460+00:00","message":"Chromium sandbox provides an additional layer of protection, but is not supported for Linux Red Hat Linux 9.7 OS. Automatically setting 'xpack.screenshotting.browser.chromium.disableSandbox: true'.","log":{"level":"WARN","logger":"plugins.screenshotting.config"},"process":{"pid":7,"uptime":22.097517135},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:33.706+00:00","message":"Hashed 'xpack.security.encryptionKey' for this instance: hrAkFgM7+1XQTttrkRAH8sf8Do7CsG2BD16JQfIjx6I=","log":{"level":"INFO","logger":"plugins.security.config"},"process":{"pid":7,"uptime":22.097691825},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:33.706+00:00","message":"Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.","log":{"level":"WARN","logger":"plugins.security.config"},"process":{"pid":7,"uptime":22.097812984},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:33.737+00:00","message":"Hashed 'xpack.security.encryptionKey' for this instance: hrAkFgM7+1XQTttrkRAH8sf8Do7CsG2BD16JQfIjx6I=","log":{"level":"INFO","logger":"plugins.security.config"},"process":{"pid":7,"uptime":22.097947573},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:33.737+00:00","message":"Using secure cookies, but SSL is not enabled inside Kibana. SSL must be configured outside of Kibana to function properly.","log":{"level":"WARN","logger":"plugins.security.config"},"process":{"pid":7,"uptime":22.098082612},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:33.776+00:00","message":"Telemetry collection is disabled. For more information on telemetry settings, refer to https://www.elastic.co/docs/reference/kibana/configuration-reference/telemetry-settings.","log":{"level":"INFO","logger":"plugins.telemetry"},"process":{"pid":7,"uptime":22.09821721},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:33.919+00:00","message":"Hashed 'xpack.encryptedSavedObjects.encryptionKey' for this instance: +7xHst18NScX1oUE69enqWazcEWmyW3XnPWm+VPp+Yw=","log":{"level":"INFO","logger":"plugins.encryptedSavedObjects"},"process":{"pid":7,"uptime":22.098358351},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:34.071+00:00","message":"Email Service Error: Email connector not specified.","log":{"level":"INFO","logger":"plugins.notifications"},"process":{"pid":7,"uptime":22.098510943},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:34.723+00:00","message":"CPS feature flag set to undefined","log":{"level":"INFO","logger":"elasticsearch-service"},"process":{"pid":7,"uptime":22.098747724},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:35.232+00:00","message":"using indexes and aliases for persisting alerts","log":{"level":"INFO","logger":"plugins.alerting"},"process":{"pid":7,"uptime":22.098993497},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:35.949+00:00","message":"Registered telemetry collector for agent_builder","log":{"level":"INFO","logger":"plugins.onechat.telemetry"},"process":{"pid":7,"uptime":22.099206806},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:35.949+00:00","message":"Onechat telemetry initialized","log":{"level":"INFO","logger":"plugins.onechat"},"process":{"pid":7,"uptime":22.099320154},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:36.417+00:00","message":"Registering Case Incremental ID Task Manager","log":{"level":"INFO","logger":"plugins.cases.incremental_id_task"},"process":{"pid":7,"uptime":22.099574082},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:36.781+00:00","message":"Hashed 'xpack.reporting.encryptionKey' for this instance: 9ujCqLu4FJjIas553S5JULYvWbUVu+STxitX/SzxyqM=","log":{"level":"INFO","logger":"plugins.reporting.config"},"process":{"pid":7,"uptime":22.099709208},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:38.894+00:00","message":"Registered task successfully [Task: cloud_security_posture-stats_task]","log":{"level":"INFO","logger":"plugins.cloudSecurityPosture"},"process":{"pid":7,"uptime":22.099905675},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:40.765+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-migrations\",\"fieldMap\":{\"name\":{\"type\":\"keyword\",\"required\":true},\"created_at\":{\"type\":\"date\",\"required\":true},\"created_by\":{\"type\":\"keyword\",\"required\":true}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":22.100041573},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:40.765+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-dashboards\",\"fieldMap\":{\"@timestamp\":{\"type\":\"date\",\"required\":false},\"migration_id\":{\"type\":\"keyword\",\"required\":true},\"created_by\":{\"type\":\"keyword\",\"required\":true},\"status\":{\"type\":\"keyword\",\"required\":true},\"translation_result\":{\"type\":\"keyword\",\"required\":true},\"updated_at\":{\"type\":\"date\",\"required\":true},\"updated_by\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard\":{\"type\":\"object\",\"required\":true},\"original_dashboard.id\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.title\":{\"type\":\"text\",\"required\":true,\"fields\":{\"keyword\":{\"type\":\"keyword\"}}},\"original_dashboard.data\":{\"type\":\"text\",\"required\":true},\"original_dashboard.description\":{\"type\":\"text\",\"required\":false},\"original_dashboard.format\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.vendor\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.last_updated\":{\"type\":\"date\",\"required\":true},\"original_dashboard.splunk_properties\":{\"type\":\"object\",\"required\":true},\"original_dashboard.splunk_properties.app\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.splunk_properties.sharing\":{\"type\":\"keyword\",\"required\":true},\"original_dashboard.splunk_properties.owner\":{\"type\":\"keyword\",\"required\":true},\"elastic_dashboard\":{\"type\":\"object\",\"required\":false},\"elastic_dashboard.id\":{\"type\":\"keyword\",\"required\":false},\"elastic_dashboard.title\":{\"type\":\"text\",\"required\":true,\"fields\":{\"keyword\":{\"type\":\"keyword\"}}},\"elastic_dashboard.description\":{\"type\":\"text\",\"required\":false},\"elastic_dashboard.data\":{\"type\":\"text\",\"required\":false},\"comments\":{\"type\":\"object\",\"array\":true,\"required\":false},\"comments.message\":{\"type\":\"keyword\",\"required\":true},\"comments.created_at\":{\"type\":\"date\",\"required\":true},\"comments.created_by\":{\"type\":\"keyword\",\"required\":true}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":22.100170787},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:40.765+00:00","message":"{\"message\":\"Creating dashboard index pattern adapter\",\"name\":\".kibana-siem-dashboard-migrations-resources\",\"fieldMap\":{\"migration_id\":{\"type\":\"keyword\",\"required\":true},\"type\":{\"type\":\"keyword\",\"required\":true},\"name\":{\"type\":\"keyword\",\"required\":true},\"content\":{\"type\":\"text\",\"required\":false},\"metadata\":{\"type\":\"object\",\"required\":false},\"updated_at\":{\"type\":\"date\",\"required\":false},\"updated_by\":{\"type\":\"keyword\",\"required\":false}}}","log":{"level":"WARN","logger":"plugins.securitySolution.siemDashboardMigrations"},"process":{"pid":7,"uptime":22.100288495},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:40.837+00:00","message":"Registering endpoint:user-artifact-packager task with timeout of [20m], interval of [60s] and policy update batch size of [25]","log":{"level":"INFO","logger":"plugins.securitySolution.endpoint:user-artifact-packager:1.0.0"},"process":{"pid":7,"uptime":22.100415384},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:40.837+00:00","message":"Registering task [endpoint:complete-external-response-actions] with timeout of [5m] and run interval of [60s]","log":{"level":"INFO","logger":"plugins.securitySolution.endpoint:complete-external-response-actions"},"process":{"pid":7,"uptime":22.100524476},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}} {"event":{"action":"kibana_started.elasticsearch.waitTime","category":"database","duration":17,"type":"connection"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:41.928+00:00","message":"Successfully connected to Elasticsearch after waiting for 17 milliseconds","log":{"level":"INFO","logger":"elasticsearch-service"},"process":{"pid":7,"uptime":22.112207125},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.029+00:00","message":"Waiting until all Elasticsearch nodes are compatible with Kibana before starting saved objects migrations...","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.213217847},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.030+00:00","message":"Starting saved objects migrations","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.21362928},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.131+00:00","message":"[.kibana_usage_counters] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 30ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.314883767},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.131+00:00","message":"[.kibana_alerting_cases] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 24ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.315176968},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.131+00:00","message":"[.kibana_usage_counters] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 5ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.315344157},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.132+00:00","message":"[.kibana_usage_counters] UPDATE_SOURCE_MAPPINGS_PROPERTIES -> CLEANUP_UNKNOWN_AND_EXCLUDED. took: 1ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.315484733},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.132+00:00","message":"[.kibana_analytics] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 36ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.315701771},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.132+00:00","message":"[.kibana] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 43ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.315871366},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.132+00:00","message":"[.kibana_task_manager] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 42ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.31601785},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.132+00:00","message":"[.kibana_analytics] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 5ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.316168919},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.132+00:00","message":"[.kibana] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 5ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.316302536},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.133+00:00","message":"[.kibana_security_solution] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 43ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.316440605},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.133+00:00","message":"[.kibana_search_solution] INIT -> CREATE_INDEX_CHECK_CLUSTER_ROUTING_ALLOCATION. took: 39ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.316573087},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.133+00:00","message":"[.kibana_alerting_cases] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 19ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.3167029},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.133+00:00","message":"[.kibana_security_solution] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 5ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.316836942},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.133+00:00","message":"[.kibana_ingest] INIT -> WAIT_FOR_YELLOW_SOURCE. took: 41ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.317001247},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.133+00:00","message":"[.kibana_search_solution] CREATE_INDEX_CHECK_CLUSTER_ROUTING_ALLOCATION -> CREATE_NEW_TARGET. took: 7ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.317143269},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.133+00:00","message":"[.kibana_task_manager] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 16ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.317253487},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.133+00:00","message":"[.kibana_ingest] WAIT_FOR_YELLOW_SOURCE -> UPDATE_SOURCE_MAPPINGS_PROPERTIES. took: 4ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.317363917},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.134+00:00","message":"[.kibana_search_solution] CREATE_NEW_TARGET -> FATAL. took: 24ms.","log":{"level":"INFO","logger":"savedobjects-service"},"process":{"pid":7,"uptime":22.317464128},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.134+00:00","message":"Kibana is shutting down","log":{"level":"INFO","logger":"root"},"process":{"pid":7,"uptime":22.317729733},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.135+00:00","message":"Reason: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\nError: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\n at migrationStateActionMachine (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/migrations_state_action_machine.js:99:29)\n at processTicksAndRejections (node:internal/process/task_queues:105:5)\n at /usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/run_v2_migration.js:162:22\n at async Promise.all (index 6)\n at KibanaMigrator.runMigrationsInternal (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/kibana_migrator.js:172:16)\n at SavedObjectsService.start (/usr/share/kibana/node_modules/@kbn/core-saved-objects-server-internal/src/saved_objects_service.js:215:7)\n at Server.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/server.js:437:31)\n at Root.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/root/index.js:67:14)\n at bootstrap (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/bootstrap.js:119:5)\n at Command. (/usr/share/kibana/src/cli/serve/serve.js:236:5)","log":{"level":"FATAL","logger":"root"},"process":{"pid":7,"uptime":22.318775985},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.138+00:00","message":"Stopping all plugins.","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":22.321972677},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.139+00:00","message":"All plugins stopped.","log":{"level":"INFO","logger":"plugins-system.preboot"},"process":{"pid":7,"uptime":22.322683606},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.139+00:00","message":"Stopping all plugins.","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":22.322822972},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.142+00:00","message":"Monitoring stats collection is stopped","log":{"level":"INFO","logger":"plugins.monitoring.monitoring.kibana-monitoring"},"process":{"pid":7,"uptime":22.326671374},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.149+00:00","message":"All plugins stopped.","log":{"level":"INFO","logger":"plugins-system.standard"},"process":{"pid":7,"uptime":22.332863006},"trace":{"id":"3ab8430e24646ef82f6275dea15ad106"},"transaction":{"id":"3555970b0fc39b41"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2026-05-28T19:21:42.809+00:00","message":"Browser executable: /usr/share/kibana/node_modules/@kbn/screenshotting-plugin/chromium/headless_shell-linux_x64/headless_shell","log":{"level":"INFO","logger":"plugins.screenshotting.chromium"},"process":{"pid":7,"uptime":22.993563933},"trace":{"id":"57010fd37f90429368ae1f4a1fa1aff0"},"transaction":{"id":"e09a7426d438441a"}}
Please, help to find the cause and restore Kibana access. Guidelines
|
Answered by
Zer0-cyber-web
May 29, 2026
Replies: 2 comments 1 reply
|
Well, I figured out myself :) The reason is that my previous installation had ElasticSearch limitation in 1000 shards. And logs said that there were errors about that: Details
@timestamp":"2026-05-28T15:02:01.471+00:00","message":"Reason: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\nError: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\n at migrationStateActionMachine (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/migrations_state_action_machine.js:99:29)\n at processTicksAndRejections (node:internal/process/task_queues:105:5)\n at /usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/run_v2_migration.js:162:22\n at async Promise.all (index 6)\n at KibanaMigrator.runMigrationsInternal (/usr/share/kibana/node_modules/@kbn/core-saved-objects-migration-server-internal/src/kibana_migrator.js:172:16)\n at SavedObjectsService.start (/usr/share/kibana/node_modules/@kbn/core-saved-objects-server-internal/src/saved_objects_service.js:215:7)\n at Server.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/server.js:437:31)\n at Root.start (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/root/index.js:67:14)\n at bootstrap (/usr/share/kibana/node_modules/@kbn/core-root-server-internal/src/bootstrap.js:119:5)\n at Command. (/usr/share/kibana/src/cli/serve/serve.js:236:5)","log":{"level":"FATAL","logger":"root"},"process":{"pid":7,"uptime":58.944236199},"trace":{"id":"acbf947deafd6107c151bff220d7b844"},"transaction":{"id":"5a499983b1801e9b"}} {"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"}," You will need ElasticSearch password for that: sudo cat /opt/so/conf/elasticsearch/curl.configSo I increased shards limit to 3000 in CLI, since ElasticSearch itself was working properly (replace ${ESPASS} with your ElasticSeach password): curl -sk -u "so_elastic:${ESPASS}" -X PUT "https://192.168.xx.xx:9200/_cluster/settings" \
-H "Content-Type: application/json" \
-d '{"persistent": {"cluster.max_shards_per_node": 3000}}'then restarted Kibana: sudo docker restart so-kibanaNow Kibana starts and works properly. UPD: After starting Kibana I managed ILM policies to reduce shards usage. Then I reverted shards limits in Dev.Console with: PUT /_cluster/settings
{
"persistent": {
"cluster.max_shards_per_node": 2000
}
}So now shards limit is back to 1000, and amount of active shards is 766. # so-elasticsearch-query _cluster/health?pretty
{
"cluster_name" : "securityonion",
"status" : "green",
"timed_out" : false,
"number_of_nodes" : 1,
"number_of_data_nodes" : 1,
"active_primary_shards" : 766,
"active_shards" : 766,
"relocating_shards" : 0,
"initializing_shards" : 0,
"unassigned_shards" : 0,
"unassigned_primary_shards" : 0,
"delayed_unassigned_shards" : 0,
"number_of_pending_tasks" : 0,
"number_of_in_flight_fetch" : 0,
"task_max_waiting_in_queue_millis" : 0,
"active_shards_percent_as_number" : 100.0
}
|
0 replies
Answer selected by
Zer0-cyber-web
|
Increasing the maximum shards per node isn't recommended. Temporarily its okay, but as more shards are created you will run into memory issues. You should look at lowering retention via adjusting your ILM policies to get rid of some of the older data and free up some of those original 1000 shards. |
1 reply
|
Thank you! Now I am managing my ILM settings in order to free up shards. UPD: After ILM adjustment I reduced shards count to 766, and also it freed up /nsm disk space. So anyway it was useful! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Well, I figured out myself :)
The reason is that my previous installation had ElasticSearch limitation in 1000 shards. And logs said that there were errors about that:
Details
@timestamp":"2026-05-28T15:02:01.471+00:00","message":"Reason: Unable to complete saved object migrations for the [.kibana_search_solution] index: [cluster_shard_limit_exceeded] Upgrading Kibana requires adding a small number of new shards. Ensure that Kibana is able to add 10 more shards by increasing the cluster.max_shards_per_node setting, or removing indices to clear up resources. See https://www.elastic.co/docs/troubleshoot/kibana/migration-failures#cluster-shard-limit-exceeded\nError: Unable to complete saved…