Bug 1519522 – Admin user should be able to see orphaned index in kibana

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1519522 - Admin user should be able to see orphaned index in kibana

Summary:	Admin user should be able to see orphaned index in kibana

Status:	CLOSED ERRATA

Aliases:	None

Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Logging (Show other bugs)
Sub Component:
Version:	3.7.0
Hardware:	Unspecified Unspecified

Priority	high Severity medium
Target Milestone:	---
Target Release:	3.9.z
Assigned To:	Jeff Cantrill
QA Contact:	Anping Li
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2017-11-30 15:11 EST by Vikas Laad
Modified:	2018-07-18 21:54 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Enhancement
Doc Text:	Feature: Provide a way for administrators to see messages for which we are unable to determine the proper namespace to associate with them Reason: Messages otherwise appear to be missing and are otherwise not viewable for review. Result: A Kibana Index pattern will be created for administrators if it does not exist.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-05-17 02:42:42 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
kibana and orphan messages (114.12 KB, image/png) 2018-02-12 09:19 EST, Jeff Cantrill	no flags	Details
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2018:1566	None	None	None	2018-05-17 02:43 EDT

Groups: None (edit)

Description Vikas Laad 2017-11-30 15:11:58 EST

Description of problem:
When fluentd is not able to find namespace or pod metadata it pushes that message to '.orphaned' index. Currently there is no way to see that index in kibana until es pod settings are modified manually.

Version-Release number of selected component (if applicable):
openshift v3.7.9
kubernetes v1.7.6+a08f5eeb62
etcd 3.2.8

How reproducible:
when someone need to look for messages in kibana under orphaned index.

Steps to Reproduce:
1. Create few pods which are logging at high rate (currently i was able to do it @ 1250 messages/mux/sec)
2. delete projects 
3. see indexes, there will be a index project..orphaned.orphaned*

Actual results:
Messages are not visible in kibana.

Expected results:
Admins should be able to see logs in kibana

Additional info:

Comment 2 Jeff Cantrill 2018-01-15 15:57:37 EST

Pushing to 3.10 as the filter code still is not published in the code base.

Comment 3 Jeff Cantrill 2018-02-12 09:19 EST

Created attachment 1394934 [details]
kibana and orphan messages

Comment 4 Jeff Cantrill 2018-04-13 13:23:37 EDT

This will be resolved by https://github.com/openshift/origin-aggregated-logging/pull/1048

Comment 8 Anping Li 2018-05-02 07:32:56 EDT

The orphaned index can be view by cluster-admin in v3.9.27

Comment 9 Anping Li 2018-05-02 07:33:43 EDT

.project.* and .orphaned  index pattern are set by default

Comment 12 errata-xmlrpc 2018-05-17 02:42:42 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1566

Note You need to log in before you can comment on or make changes to this bug.