Bug 1519522 - Admin user should be able to see orphaned index in kibana
Summary: Admin user should be able to see orphaned index in kibana
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 3.7.0
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: ---
: 3.9.z
Assignee: Jeff Cantrill
QA Contact: Anping Li
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-11-30 20:11 UTC by Vikas Laad
Modified: 2018-07-19 01:54 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Feature: Provide a way for administrators to see messages for which we are unable to determine the proper namespace to associate with them Reason: Messages otherwise appear to be missing and are otherwise not viewable for review. Result: A Kibana Index pattern will be created for administrators if it does not exist.
Clone Of:
Environment:
Last Closed: 2018-05-17 06:42:42 UTC
Target Upstream Version:

Attachments (Terms of Use)
kibana and orphan messages (114.12 KB, image/png)
2018-02-12 14:19 UTC, Jeff Cantrill 		no flags Details
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:1566 None None None 2018-05-17 06:43:24 UTC

Description Vikas Laad 2017-11-30 20:11:58 UTC 
Description of problem:
When fluentd is not able to find namespace or pod metadata it pushes that message to '.orphaned' index. Currently there is no way to see that index in kibana until es pod settings are modified manually.

Version-Release number of selected component (if applicable):
openshift v3.7.9
kubernetes v1.7.6+a08f5eeb62
etcd 3.2.8

How reproducible:
when someone need to look for messages in kibana under orphaned index.

Steps to Reproduce:
1. Create few pods which are logging at high rate (currently i was able to do it @ 1250 messages/mux/sec)
2. delete projects 
3. see indexes, there will be a index project..orphaned.orphaned*

Actual results:
Messages are not visible in kibana.

Expected results:
Admins should be able to see logs in kibana

Additional info:
Comment 2 Jeff Cantrill 2018-01-15 20:57:37 UTC 
Pushing to 3.10 as the filter code still is not published in the code base.
Comment 3 Jeff Cantrill 2018-02-12 14:19:24 UTC 
Created attachment 1394934 [details]
kibana and orphan messages
Comment 4 Jeff Cantrill 2018-04-13 17:23:37 UTC 
This will be resolved by https://github.com/openshift/origin-aggregated-logging/pull/1048
Comment 8 Anping Li 2018-05-02 11:32:56 UTC 
The orphaned index can be view by cluster-admin in v3.9.27
Comment 9 Anping Li 2018-05-02 11:33:43 UTC 
.project.* and .orphaned  index pattern are set by default
Comment 12 errata-xmlrpc 2018-05-17 06:42:42 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1566
Note You need to log in before you can comment on or make changes to this bug.