Description of problem: Elaticsearch pods are reporting below warning: [2021-08-31T18:15:04,239][WARN ][r.suppressed ] [elasticsearch-cdm-lp4bg7d4-1] path: /_alias/infra-write, params: {name=infra-write} org.elasticsearch.transport.RemoteTransportException: [elasticsearch-cdm-lp4bg7d4-2][10.102.12.96:9300][indices:admin/aliases/get] Caused by: org.elasticsearch.ElasticsearchSecurityException: _opendistro_security_dls_query does not match (SG 900D) at com.amazon.opendistroforelasticsearch.security.privileges.DlsFlsEvaluator.evaluate(DlsFlsEvaluator.java:128) ~[?:?] at com.amazon.opendistroforelasticsearch.security.privileges.PrivilegesEvaluator.evaluate(PrivilegesEvaluator.java:443) ~[?:?] at com.amazon.opendistroforelasticsearch.security.filter.OpenDistroSecurityFilter.apply0(OpenDistroSecurityFilter.java:287) ~[?:?] All the elasticsearch-im jobs are completed successfully: $ oc -nopenshift-logging get jobs NAME COMPLETIONS DURATION AGE curator-1630467000 1/1 4s 15h elasticsearch-im-app-1630522800 1/1 4s 7m19s elasticsearch-im-audit-1630522800 1/1 4s 7m19s elasticsearch-im-infra-1630522800 1/1 4s 7m19s - Health of elasticsearch cluster is green. - Fluentd doesn't have any stuck buffers. - There is no time delay while viewing logs in kibana. - Elasticsearch and ClusterLogging operators are using 4.6 stable channel in subscription Version-Release number of selected component (if applicable): 4.6.43 How reproducible: NA Steps to Reproduce: 1. NA 2. 3. Actual results: Elasticsearch pod logs show below warning: [2021-08-31T18:15:04,239][WARN ][r.suppressed ] [elasticsearch-cdm-lp4bg7d4-1] path: /_alias/infra-write, params: {name=infra-write} org.elasticsearch.transport.RemoteTransportException: [elasticsearch-cdm-lp4bg7d4-2][10.102.12.96:9300][indices:admin/aliases/get] Caused by: org.elasticsearch.ElasticsearchSecurityException: _opendistro_security_dls_query does not match (SG 900D) Expected results: Elasticsearch should not report above said warning. Additional info:
Hey @tmicheli
It happens to be that someone is already investigating on this issue. This bug is same as https://bugzilla.redhat.com/show_bug.cgi?id=1985826. Hence, I am closing it as a DUPLICATE. Please follow the thread over here https://issues.redhat.com/browse/LOG-1868 to get further updates on the investigation for this issue. *** This bug has been marked as a duplicate of bug 1985826 ***
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days