Cause: Aliasing only occurs when a user logs into Kibana. If the the openshift-elasticsearch-plugin is not
functioning correctly then aliasing may not occur.
Consequence: .all alias will not be associated with all indices
Fix: Use Elasticsearch index templates to alias all newly created indices
Result: All newly created indices will be aliased to .all
Created attachment 1399435[details]
list of updates applied
Description of problem:
The .all alias exists but after a certain date, it is longer updated - even though other indices _are_ created and are searchable after this date. This date coincides with platform updates the customer applied (see attached for a list) and then a reboot.
OCP was a fresh install and not an upgrade.
Version-Release number of selected component (if applicable):
OCP 3.6.173.0.5
Dockerfile info: /root/buildinfo/Dockerfile-openshift3-logging-curator-v3.6.173.0.96-2
"build-date"="2018-01-10T22:14:06.235392"
Dockerfile info: /root/buildinfo/Dockerfile-openshift3-logging-elasticsearch-v3.6.173.0.96-3
"build-date"="2018-01-18T13:02:43.616483"
Dockerfile info: /root/buildinfo/Dockerfile-openshift3-logging-auth-proxy-v3.6.173.0.96-2
"build-date"="2018-01-10T22:14:09.238369"
Dockerfile info: /root/buildinfo/Dockerfile-openshift3-logging-fluentd-v3.6.173.0.96-2
"build-date"="2018-01-10T22:14:59.119836"
How reproducible:
Not certain. The .all alias stopped being updated after the customer applied platform updates and rebooted (see attached for list of updates applied).
Steps to Reproduce:
1.install OCP 3.6.173.0.5
2.apply updates listed in attached
3.reboot platform
Actual results:
.all alias stops updating
Expected results:
.all alias doesn't stop updating and continues to be searchable
Additional info:
Customer also has a 3.7 cluster that may be exhibiting the same problems.
logging-dump.sh script attached.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2018:2234
Created attachment 1399435 [details] list of updates applied Description of problem: The .all alias exists but after a certain date, it is longer updated - even though other indices _are_ created and are searchable after this date. This date coincides with platform updates the customer applied (see attached for a list) and then a reboot. OCP was a fresh install and not an upgrade. Version-Release number of selected component (if applicable): OCP 3.6.173.0.5 Dockerfile info: /root/buildinfo/Dockerfile-openshift3-logging-curator-v3.6.173.0.96-2 "build-date"="2018-01-10T22:14:06.235392" Dockerfile info: /root/buildinfo/Dockerfile-openshift3-logging-elasticsearch-v3.6.173.0.96-3 "build-date"="2018-01-18T13:02:43.616483" Dockerfile info: /root/buildinfo/Dockerfile-openshift3-logging-auth-proxy-v3.6.173.0.96-2 "build-date"="2018-01-10T22:14:09.238369" Dockerfile info: /root/buildinfo/Dockerfile-openshift3-logging-fluentd-v3.6.173.0.96-2 "build-date"="2018-01-10T22:14:59.119836" How reproducible: Not certain. The .all alias stopped being updated after the customer applied platform updates and rebooted (see attached for list of updates applied). Steps to Reproduce: 1.install OCP 3.6.173.0.5 2.apply updates listed in attached 3.reboot platform Actual results: .all alias stops updating Expected results: .all alias doesn't stop updating and continues to be searchable Additional info: Customer also has a 3.7 cluster that may be exhibiting the same problems. logging-dump.sh script attached.