Issue with role permissions for user role mapping with AAD

We also had a similar issue after upgrading to major version 8. Even as superuser we got this error.
Our issue was similar to yours and Receiving org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed after 7.17.1 to 8.2.3 upgrade

We were able to resolve it by removing an excess comma within the data view definition.
In Stack Management -> Data Views we searched for the ID given in the error message. Editing this data view showed that Kibana was not able to correctly parse the given index pattern due to the additional comma. Once fixed it showed the correct indices on the right hand side.
After saving the data view the issue was resolved for us.

Seeing your error, I think there may be something wrong with the data view too, unless you have indices start with a dash (as the pattern begins with -elastic-cloud-logs- in the error message)

1 Like