Kibana Fleet error after upgrading Elastic Cloud to 7.11

Elastic Stack Kibana
#1

Hi,

We get the following error when opening fleet page after upgrading from 7.10.2 to 7.11:

Unable to initialize Fleet

[illegal_argument_exception] updating component template [logs-endpoint.events.file-mappings] results in invalid composable template [logs-endpoint.events.file] after templates are merged response from /_component_template/logs-endpoint.events.file-mappings: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"updating component template [logs-endpoint.events.file-mappings] results in invalid composable template [logs-endpoint.events.file] after templates are merged"}],"type":"illegal_argument_exception","reason":"updating component template [logs-endpoint.events.file-mappings] results in invalid composable template [logs-endpoint.events.file] after templates are merged","caused_by":{"type":"illegal_argument_exception","reason":"template [logs-endpoint.events.file] has alias and data stream definitions"}},"status":400}

How to solve the issue?

Regards,
Nugroho

#2

Adding more information. Sometimes I get this error:

image
image1221×119 5.85 KB

When I refresh I get a different error:

image
image1120×219 29.2 KB

#3

Hi @nugroho-expereo ,

this sounds a lot like a problem we fixed during development in [Fleet] Do not defined aliases inside datastream template by nchaulet · Pull Request #89512 · elastic/kibana · GitHub -- are you using the release, or an earlier snapshot?

#4

Hi @skh I am not sure I understand your question but we used Upgrade link in the Elastic cloud managed service to upgrade from 7.10.2 to 7.11.0.

#5

Hi @nugroho-expereo this answers my question, thank you! We're looking into it.

#6

@nugroho-expereo Please open a support ticket from Elastic cloud, that will help us better investigate this and find the root cause faster.

#7

I opened a similar issue here, didn't find this post before unfortunately.

=> [Fleet] Upgrade to 7.11 failed · Issue #90984 · elastic/kibana · GitHub

#8

We're working on a fix for this issue.

In the mean time, there is a workaround:

Open the Fleet UI and pick the problematic index template from the error message:

1600×274 193 KB

The problematic template here is logs-endpoint.alerts -- pick the composable template, not the component template from the error message.

In Kibana dev tools, read that template with

GET _index_template/logs-endpoint.alerts

From the first and only search result, copy out the content of the index_template property and paste it into a separate text file.

1299×947 94.1 KB

Remove the offending aliases property

1237×477 38.9 KB

1237×477 37.1 KB

Copy the changed JSON content and write it back to ES in kibana dev tools with

943×609 65.5 KB

Use the Autoindent feature in dev tools so you’re sure the JSON has balanced brackets.

Go back to the Fleet UI, which will show the same error but for another composable template. Repeat these steps until the Fleet UI comes up normally again.

#9

Thanks. It works now after performing the workaround.

1 Like