Bug 1519522

Summary: Admin user should be able to see orphaned index in kibana
Product: OpenShift Container Platform Reporter: Vikas Laad <vlaad>
Component: LoggingAssignee: Jeff Cantrill <jcantril>
Status: CLOSED ERRATA QA Contact: Anping Li <anli>
Severity: medium Docs Contact:
Priority: high    
Version: 3.7.0CC: aos-bugs, mifiedle, rmeggins
Target Milestone: ---   
Target Release: 3.9.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Enhancement
Doc Text:
Feature: Provide a way for administrators to see messages for which we are unable to determine the proper namespace to associate with them Reason: Messages otherwise appear to be missing and are otherwise not viewable for review. Result: A Kibana Index pattern will be created for administrators if it does not exist.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2018-05-17 06:42:42 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
kibana and orphan messages none

Description Vikas Laad 2017-11-30 20:11:58 UTC 
Description of problem:
When fluentd is not able to find namespace or pod metadata it pushes that message to '.orphaned' index. Currently there is no way to see that index in kibana until es pod settings are modified manually.

Version-Release number of selected component (if applicable):
openshift v3.7.9
kubernetes v1.7.6+a08f5eeb62
etcd 3.2.8

How reproducible:
when someone need to look for messages in kibana under orphaned index.

Steps to Reproduce:
1. Create few pods which are logging at high rate (currently i was able to do it @ 1250 messages/mux/sec)
2. delete projects 
3. see indexes, there will be a index project..orphaned.orphaned*

Actual results:
Messages are not visible in kibana.

Expected results:
Admins should be able to see logs in kibana

Additional info:
Comment 2 Jeff Cantrill 2018-01-15 20:57:37 UTC 
Pushing to 3.10 as the filter code still is not published in the code base.
Comment 3 Jeff Cantrill 2018-02-12 14:19:24 UTC 
Created attachment 1394934 [details]
kibana and orphan messages
Comment 4 Jeff Cantrill 2018-04-13 17:23:37 UTC 
This will be resolved by https://github.com/openshift/origin-aggregated-logging/pull/1048
Comment 8 Anping Li 2018-05-02 11:32:56 UTC 
The orphaned index can be view by cluster-admin in v3.9.27
Comment 9 Anping Li 2018-05-02 11:33:43 UTC 
.project.* and .orphaned  index pattern are set by default
Comment 12 errata-xmlrpc 2018-05-17 06:42:42 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1566