Kibana 403 'Unable to update UI setting' Error while searching on multi-match index pattern

[devops_guy1 (Guy)]

Hi,

I am trying to simulate a multi-tenancy Kibana setup with multiple roles and role mappings, and running into issues with Kibana making strange HTTP calls to itself (just like in this page Unable to update UI setting Request failed with status code: 403) while attempting to use certain index patterns.

My Setup:

• Running RPM installations of Elasticsearch and Kibana 7.6.1 on the same VM

• 2 Elasticsearch Roles which give Read permissions to indices matching "prefix-service1-*" and "prefix-service2-*" respectively.

• 2 indices named prefix-service1-2020-06-01 and prefix-service2-2020-06-01

• 3 index patterns "prefix-*", "prefix-service1-*", and "prefix-service2-*"

• A user that can authenticate/log in to Kibana, with both roles assigned successfully.

---

The Issue:
when querying from the Discover page, with one of the more specific index patterns ("prefix-service1-*" for example) documents from the appropriate index show up just fine.
But when using the more "generic" index pattern ("prefix-*") that matches multiple indices:

1. only documents from prefix-service1-2020-06-01 are displayed

2. An error pops up on the screen saying:

   • Unable to update UI setting \n Request failed with status code: 403

3. Using the chrome developer console I can see this happens right when an API call is made to http://<kibana_host>:5601/s/<space_name>/api/kibana/settings with a payload of:

{"changes" : {"defaultIndex":"********-****-****-****-************"}}

(where "*"s are a mix of either lowercase chars and numbers)

---

I would greatly appreciate any advice or instruction on how to get the "general" index pattern to show documents from all matching indices, and resolve the error/bad API call

[markov00 (Marco Vettorello)]

Hi @devops_guy1
There can be two main issue that are causing this 403 error:

• you don't have a default index-pattern configured
• this role doesn't have access to the configured default index-pattern

Please check a default index-pattern is available, or configure one if not.
Please also subscribe to the updates on this PR that should fix this issue: https://github.com/elastic/kibana/pull/54122

[devops_guy1 (Guy)]

Thanks for taking the time to answer @markov00,

Looking at the reproduction steps on the issue you sent, it looks to be pretty much my use case. I'll be sure to follow up, hope a fix makes it into a release soon...