Bug 2034412

Summary:	Elasticsearch rejects logs with resourceVersion larger than int32
Product:	OpenShift Container Platform	Reporter:	Gerard Vanloo <gvanloo>
Component:	Logging	Assignee:	Gerard Vanloo <gvanloo>
Status:	CLOSED ERRATA	QA Contact:	Anping Li <anli>
Severity:	high	Docs Contact:
Priority:	high
Version:	4.6	CC:	aos-bugs
Target Milestone:	---
Target Release:	4.6.z
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	logging-exploration
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Consequence of Fix: The fix provided requires that the data model be changed. However, as a result, existing indices will cause an warning/error within Kibana. This field ("kubernetes.event.metadata.resourceVersion") will be broken until the existing indices are removed or reindexed. If this field is not in use in Kibana, then the message can be ignored. For those with a delete policy, the old indices will eventually be removed. When that occurs, the message will be removed. For those without that policy, the cluster will need to be reindexed in order to remove the message.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-01-27 08:26:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Gerard Vanloo 2021-12-20 20:38:18 UTC

Description of problem:

Originally reported here: https://issues.redhat.com/browse/LOG-2022

When a log has a resourceVersion larger than an int32, Elasticsearch will reject the log with a 400 error.

Comment 1 Gerard Vanloo 2021-12-27 16:27:36 UTC

The fix provided requires that the data model be changed. However, as a result, existing indices will cause an warning/error within Kibana. This field ("kubernetes.event.metadata.resourceVersion") will be broken until the existing indices are removed or reindexed.

If this field is not in use in Kibana, then the message can be ignored. For those with a delete policy, the old indices will eventually be removed. When that occurs, the message will be removed. For those without that policy, the cluster will need to be reindexed in order to remove the message.

Comment 3 Anping Li 2022-01-12 14:57:24 UTC

Fixed on csv:elasticsearch-operator.4.6.0-202201111633, image: openshift/ose-elasticsearch-proxy/images/v4.6.0-202201111633.p0.g12d80b2.assembly.stream

Comment 6 errata-xmlrpc 2022-01-27 08:26:04 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.6.54 extras and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:0181