Change indices settings in Metric app

[norgro2601 (Norbert Groene)]

Hi,

we have a lot of servers due to several kubernets environments, that are monitored by the Elastic stack. Due to this fact, I often get an error "Failed to load datasources" (Response 504) when opening the metrics or logs app. I want to speed up and get the search running again by changing the indices settings for each space, cause each space only uses a subset of the available filebeat and metricbeat indices.
Unfortunately the settings page is also not working after the error occurred, I get a blank screen. Is there an API that I can use to change the settings ?
And wouldn't it make more sense to have the settings added to the "Advanced Settings" on the Management panel as it is for e.g. the SIEM app ?

Thanks in advance.

Regards, Norbert

[Kerry (Kerry Gallagher)]

Hi @norgro2601 ,

Sorry to hear about the difficulties you've been having with loading certain pages. We are looking into improving this, but I can't give any exact timeframes.

For the meantime let's try and get you back up and running with a source configuration that points to less indices. What we need to do is update the Kibana SavedObject that holds information about your Source Configuration. The Source Configuration is the settings shared between the Metrics / Logs solutions.

The name of this SavedObject is infrastructure-ui-source, and the savedObjects are space aware.

We then need to update the metricAlias field for this savedObject, which denotes which metrics indices to use. And the logsAlias field which denotes which logs indices to use.

This can be done with the following API call - this would update the default infrastructure-ui-source savedObject for the example space:

curl -X PUT "<KIBANA_URL>/s/<SPACE_ID>/api/saved_objects/infrastructure-ui-source/default" --user <USERNAME>:<PASSWORD> -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'
{
  "attributes": {
    "metricAlias": "some-scoped-indices-*",
    "logsAlias": "some-scoped-indices-*",
  }
}
'

Docs: https://www.elastic.co/guide/en/kibana/master/saved-objects-api-update.html

[norgro2601 (Norbert Groene)]

Hi Kerry,

thanks for your suggestion. Unfortunately, it is not working in my environment. When I try to update the default setting for a space, the response is
{"statusCode":404,"error":"Not Found","message":"Saved object [infrastructure-ui-source/default] not found"}
I've then tried to do an update in the default space, the response is
{"message":"mapping set to strict, dynamic introduction of [logsAlias] within [infrastructure-ui-source] is not allowed: [strict_dynamic_mapping_exception] mapping set to strict, dynamic introduction of [logsAlias] within [infrastructure-ui-source] is not allowed","statusCode":400,"error":"Bad Request"}

Maybe the problem is, that the stack is running in Elastic Cloud ? I've missed to mention this in the question.

Regards,
Norbert

[norgro2601 (Norbert Groene)]

Hi Kerry,

I've now created new saved objects for the metrics ui in each of the spaces with the api, and it works perfect. Thanks again for pointing me in the right direction.

Regards,
Norbert