Issue with kibana/es after update to 9.1.0

Elastic Stack Elasticsearch
1

Hello Community and Elastic team,
We are using the ECK community version Installed in a AKS with k8s version 1.32.6.
We just updated the installation to 9.1.0 from 8.15.x. No we are unable to create index templates, it throws the error:

{
  "statusCode": 500,
  "error": "Internal Server Error",
  "message": "Determinizing automaton with 723 states and 779 transitions would require more than 10000 effort.",
  "attributes": {
    "error": {
      "root_cause": [
        {
          "type": "too_complex_to_determinize_exception",
          "reason": "Determinizing automaton with 723 states and 779 transitions would require more than 10000 effort."
        }
      ],
      "type": "too_complex_to_determinize_exception",
      "reason": "Determinizing automaton with 723 states and 779 transitions would require more than 10000 effort."
    }
  }
}

This happens independently from index pattern.

ECK Setup:
number of nodes: 13
3 master nodes, 6 hot nodes and 4 cold nodes.
There is no additional options enabled for elasticsearch resource.

example of a index_template creation request that fail with above exception:

PUT _index_template/my-index-template-name
{
  "template": {
    "settings": {
      "index": {
        "mode": "standard"
      }
    }
  },
  "index_patterns": [
    "some-index"
  ],
  "data_stream": {}
}

If any more information is needed please let me know.
Thanks in advance,

2

Did you follow a supported upgrade path when you performed the upgrade?

3

Yes, the operator does not accept anything different from that. I first updated to 8.19.x and only after that I was able to update to 9.1.0.

1 Like
4

One more information that might be useful.
I have checked logs and this is happening here, whenever it is checking for conflicts between index_templates.
I already tried to update the setting xpack.security.automata.max_determinized_states, but this do not have any effect at all.

5

For those who have the same issue, my team found out what was the issue.
Please take a look on this issue report: `too_complex_to_determinize_exception` is thrown in a few cases due to the patterns in index template · Issue #127972 · elastic/elasticsearch · GitHub
The way to fix this, if you jumped from version 8.x to 9.x is to delete the index_template that you think is the culprit (probably the one with a lot of index patterns with more than one wildcard), and recreated it with a more simple patterns (avoiding the double+ wildcard :smiley: )