After upgrade to 7.9.0 Kibana shows : "405 Method Not Allowed"

[oicfar (Rafał Kędziorski)]

With 7.8.0 and 7.8.1 there was no problems. But now ...

{
"statusCode": 405,
"error": "Method Not Allowed",
"message": "invalid escape sequence `%{[' at index 0 of: %{[@metadata][beat]}-%{[@metadata][version]}-2020.08.23,%{[@metadata][beat]}-%{[@metadata][version]}-2020.08.24,filebeat-7.9.0-2020.08.20-000001,filebeat-7.9.0-2020.08.22-000002,filebeat-7.9.0-2020.08.24-000003,logback-2020.08.16,logback-2020.08.17,logback-2020.08.18,logback-2020.08.20,logback-2020.08.23, allowed: [GET, PUT, HEAD, DELETE]"
}

[mattkime (Matthew Kime)]

Hello @oicfar - Could you post a har file of the error?

[oicfar (Rafał Kędziorski)]

@mattkime here https://drive.google.com/file/d/18sf5Y_4z2vEQC5B3ePnp9OsBuAF2ojII/view?usp=sharing is the HAR file.

[oicfar (Rafał Kędziorski)]

I got this message every 30 seconds.

[cjcenizal]

Hi there, Rafal, Google Drive tells me I don't have authorization to access that file. Can you change permissions so that anyone can access it? Thanks.

[oicfar (Rafał Kędziorski)]

@cjcenizal try again.

[cjcenizal]

@oicfar What are these indices for?

    "%{[@metadata][beat]}-%{[@metadata][version]}-2020.08.23"
    "%{[@metadata][beat]}-%{[@metadata][version]}-2020.08.24"
    "%{[@metadata][beat]}-%{[@metadata][version]}-2020.08.25"

They seem to match the Logstash output configuration pattern. Were/are you using Logstash?

I need to investigate and figure out how we can handle this situation more gracefully in Kibana, but in the meantime if you aren't using these indices I wonder if you could delete them using Console? That should enable you to use Index Management again.

[oicfar (Rafał Kędziorski)]

@cjcenizal this is my beats.conf in logstash

input {
  beats {
    port => 5044
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => ["localhost:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      pipeline => "%{[@metadata][pipeline]}"
    }
  } else {
    elasticsearch {
      hosts => ["localhost:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    }
  }
}

Why looks the name so?

[oicfar (Rafał Kędziorski)]

Will be fixed in ELK 7.9.2!!!

After upgrade to 7.9.0 Kibana shows : “405 Method Not Allowed”