Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Index-pattern is not present [health-check] #3169

Closed
gabiwassan opened this issue Apr 15, 2021 · 3 comments · Fixed by #3232
Closed

Index-pattern is not present [health-check] #3169

gabiwassan opened this issue Apr 15, 2021 · 3 comments · Fixed by #3232
Assignees
Labels
type/bug Bug issue

Comments

@gabiwassan
Copy link
Contributor

gabiwassan commented Apr 15, 2021

Wazuh Elastic Rev
4.1.x 7.10 410x

Description
The selected index-pattern is not present, error with custom index.

Screenshots
image

Additional context
This usually happens in updates from 3.x to 4.x

Reasons of the issue

  • When the user has more than 20 index patterns, the index pattern for Wazuh alerts couldn't be present in the list of valid patterns.
    It should be refactored to check all the index patterns, but first, we could check if the selected pattern (AppState.currentIndexPattern) or the default index pattern (from config) is already created.
  • Sometimes Elasticsearch doesn't return the fields attribute in the request to the saved objects endpoint. The reason is not clearing, it happens randomly.
    To fix this is neccesary to add the query parameter fields=title&fields=fields to the request.
@gabiwassan gabiwassan self-assigned this Apr 15, 2021
@water-breather
Copy link

water-breather commented Apr 15, 2021

Elastic 7.10.2 - Wazuh-Manager 4.1.5 - Wazuh-Kibana app 4.1.5

Updating from 3.12 - 4.1.4

Following the installation steps to upload the latest template gets me past initial health check, but it appears pattern_handler.js (https://github.com/wazuh/wazuh-kibana-app/blob/34a7422668f5880ee75b0ba9ec0f5cbd91c1fe7e/public/react-services/pattern-handler.js) is encountering an issue when checking if my index pattern exists (it does). Also tried deleting existing index pattern and letting it create one for me. But this will trigger each time health checks are run on Wazuh-Kibana app.
Disabling all health checks via wazuh.yml config does not seem to prevent this from happening.

I am also using custom-index names to preserve some custom dashboards created using wazuh-alerts-3.x-* pattern
used this documentation to edit index names: https://documentation.wazuh.com/current/user-manual/kibana-app/reference/configure-indices.html

Untitled

following response is produced each time this occurs:

image

@gabiwassan
Copy link
Contributor Author

Hi @water-breather ,
Have you been able to solve this problem?
You could try to update to the new version 4.1.5 and as a suggestion clear the browser cache (you could do a test in incognito mode)

Regards

@water-breather
Copy link

water-breather commented Apr 23, 2021

Still having issues after updating. (using private browsing to rule out any cached data)I'm seeing the following error in kibana logs:

["error","elasticsearch","data"],"message":"[version_conflict_engine_exception]: [index-pattern:wazuh-alerts-3.x-*]: version conflict, document already exists (current version [248])"}

following notifications still appear when first opening wazuh, but not as often anymore:

image

No new errors in wazuhapp.log since the update. but even with health checks turned off, the page will reload shortly after loading and the above error will appear in kibana logs without the notifications.
I have not deleted the existing index pattern since updating, and have not deleted the .kibana system index (hoping to avoid re-importing saved objects if possible)

also, here is my wazuh app index-pattern setting for reference:
image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type/bug Bug issue
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants