Kibana Fleet error after upgrading Elastic Cloud to 7.11

[nugroho-expereo (Nugroho)]

Hi,

We get the following error when opening fleet page after upgrading from 7.10.2 to 7.11:

Unable to initialize Fleet

[illegal_argument_exception] updating component template [logs-endpoint.events.file-mappings] results in invalid composable template [logs-endpoint.events.file] after templates are merged response from /_component_template/logs-endpoint.events.file-mappings: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"updating component template [logs-endpoint.events.file-mappings] results in invalid composable template [logs-endpoint.events.file] after templates are merged"}],"type":"illegal_argument_exception","reason":"updating component template [logs-endpoint.events.file-mappings] results in invalid composable template [logs-endpoint.events.file] after templates are merged","caused_by":{"type":"illegal_argument_exception","reason":"template [logs-endpoint.events.file] has alias and data stream definitions"}},"status":400}

How to solve the issue?

Regards,
Nugroho

[nugroho-expereo (Nugroho)]

Adding more information. Sometimes I get this error:

When I refresh I get a different error:

[skh (Sonja Krause Harder)]

Hi @nugroho-expereo ,

this sounds a lot like a problem we fixed during development in [Fleet] Do not defined aliases inside datastream template by nchaulet · Pull Request #89512 · elastic/kibana · GitHub -- are you using the release, or an earlier snapshot?

[nugroho-expereo (Nugroho)]

Hi @skh I am not sure I understand your question but we used Upgrade link in the Elastic cloud managed service to upgrade from 7.10.2 to 7.11.0.

[skh (Sonja Krause Harder)]

Hi @nugroho-expereo this answers my question, thank you! We're looking into it.

[rudolf (Rudolf Meijering)]

@nugroho-expereo Please open a support ticket from Elastic cloud, that will help us better investigate this and find the root cause faster.

[nemhods]

I opened a similar issue here, didn't find this post before unfortunately.

=> [Fleet] Upgrade to 7.11 failed · Issue #90984 · elastic/kibana · GitHub

[skh (Sonja Krause Harder)]

We're working on a fix for this issue.

In the mean time, there is a workaround:

Open the Fleet UI and pick the problematic index template from the error message:

The problematic template here is logs-endpoint.alerts -- pick the composable template, not the component template from the error message.

In Kibana dev tools, read that template with

GET _index_template/logs-endpoint.alerts

From the first and only search result, copy out the content of the index_template property and paste it into a separate text file.

Remove the offending aliases property

Copy the changed JSON content and write it back to ES in kibana dev tools with

Use the Autoindent feature in dev tools so you’re sure the JSON has balanced brackets.

Go back to the Fleet UI, which will show the same error but for another composable template. Repeat these steps until the Fleet UI comes up normally again.

[nugroho-expereo (Nugroho)]

Thanks. It works now after performing the workaround.