Bug 2034412 - Elasticsearch rejects logs with resourceVersion larger than int32
Summary: Elasticsearch rejects logs with resourceVersion larger than int32
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 4.6
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.6.z
Assignee: Gerard Vanloo
QA Contact: Anping Li
URL:
Whiteboard: logging-exploration
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-12-20 20:38 UTC by Gerard Vanloo
Modified: 2022-01-27 08:26 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Consequence of Fix: The fix provided requires that the data model be changed. However, as a result, existing indices will cause an warning/error within Kibana. This field ("kubernetes.event.metadata.resourceVersion") will be broken until the existing indices are removed or reindexed. If this field is not in use in Kibana, then the message can be ignored. For those with a delete policy, the old indices will eventually be removed. When that occurs, the message will be removed. For those without that policy, the cluster will need to be reindexed in order to remove the message.
Clone Of:
Environment:
Last Closed: 2022-01-27 08:26:04 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift origin-aggregated-logging pull 2226 0 None open Bug 2034412: Updating resourceVersion attribute to a keyword 2021-12-20 20:51:43 UTC
Red Hat Product Errata RHSA-2022:0181 0 None None None 2022-01-27 08:26:18 UTC

Description Gerard Vanloo 2021-12-20 20:38:18 UTC 
Description of problem:

Originally reported here: https://issues.redhat.com/browse/LOG-2022

When a log has a resourceVersion larger than an int32, Elasticsearch will reject the log with a 400 error.
Comment 1 Gerard Vanloo 2021-12-27 16:27:36 UTC 
The fix provided requires that the data model be changed. However, as a result, existing indices will cause an warning/error within Kibana. This field ("kubernetes.event.metadata.resourceVersion") will be broken until the existing indices are removed or reindexed.

If this field is not in use in Kibana, then the message can be ignored. For those with a delete policy, the old indices will eventually be removed. When that occurs, the message will be removed. For those without that policy, the cluster will need to be reindexed in order to remove the message.
Comment 3 Anping Li 2022-01-12 14:57:24 UTC 
Fixed on csv:elasticsearch-operator.4.6.0-202201111633, image: openshift/ose-elasticsearch-proxy/images/v4.6.0-202201111633.p0.g12d80b2.assembly.stream
Comment 6 errata-xmlrpc 2022-01-27 08:26:04 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.6.54 extras and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:0181
Note You need to log in before you can comment on or make changes to this bug.