Kibana unable to connect to package registry after upgrade to 8.8.1

Elastic Stack Kibana
1

Hi all
I have a problems with kibana after upgrading from version 8.5.2 to version 8.8.1
All thing work normally but the intergration keep giving me this error

Kibana cannot connect to the Elastic Package Registry, which provides Elastic Agent integrations

upon searching through the log i noticed that when ever i try to access the intergration kibana give me this error log:

Invalid top-level package manifest: one or more fields missing of name, version, description, title, format_version, owner

All fleet and kibana and elastic are all 8.8.1 so i really dont know how to fix this error
I've tried the air-garped sollution and still give me the same error
Can anyone help me fix this issue.

Thanks for your time.

2

Further investigation show me some of my problems
when i curl the packet from epr.elastic.co then return me all the field then i noticed that the field format_version is not there.
On my test server intergration run fine so i asume that the problems is when i upgrade from 8.5.2 to 8.8.1.
It seems that the version change also remove the format version field from registry.
How to i fix this issue?

3

I recently hit a similar issue. Finally the culprit was the endpoint package. Uninstalling it and reinstalling solved it. Do you have the endpoint package installed? Are you able to uninstall it?

Unfortunately Fleet does not really log any good error. I also never fully got to the ground of the error. One of my assumptions was that it had to do with my test setups but seems this is not the case here.

Do you have the beta package flag enabled?

4

i've turn on/off the beta package, still not working

i 've tried to uninstall all current used intergration and kibana still cannot connect to the package registry.

Interestingly when i access the intergration using the url i can still use them like normal.
Not really sure what is the problems here.

5

When exactly do you see the error? If you go to the Fleet page or the integrations page? You shared 2 different errors above. Maybe the two are not related.

Lets dive into the two separately:

Kibana cannot connect to the Elastic Package Registry, which provides Elastic Agent integrations

I assume that is the one that you see in the integrations page.

Invalid top level packages ...

This is the one you saw in the log files. Do you also see it when you navigate to Fleet?

Going back to the "cannot connect" error. Can you share the curl command you did run? Have you changed anything in your kibana.yml ? Not now, but maybe in the past that could have an effect now?

If you could share the kibana log file, this would be helpful. If you don't want to put it out in public, feel free to share it in a private message.

6

I see this error right after i upgrade elastic to version 8.8.1

The curl i run to test curl http://127.0.0.1:8080/search?kibana.version=8.8.1
it output a json data list all package like this one:

{
    "name": "pfsense",
    "title": "pfSense",
    "version": "1.7.0",
    "release": "ga",
    "description": "Collect logs from pfSense and OPNsense with Elastic Agent.",
    "type": "integration",
    "download": "/epr/pfsense/pfsense-1.7.0.zip",
    "path": "/package/pfsense/1.7.0",
    "icons": [
      {
        "src": "/img/pfsense.svg",
        "path": "/package/pfsense/1.7.0/img/pfsense.svg",
        "title": "pfsense",
        "size": "512x143",
        "type": "image/svg+xml"
      }
    ],
    "policy_templates": [
      {
        "name": "pfsense",
        "title": "pfSense logs",
        "description": "Collect logs from pfSense systems"
      }
    ],
    "conditions": {
      "kibana": {
        "version": "^8.1.0"
      }
    },
    "owner": {
      "github": "elastic/security-external-integrations"
    },
    "categories": [
      "network",
      "security",
      "firewall_security"
    ],
    "signature_path": "/epr/pfsense/pfsense-1.7.0.zip.sig"
  }

since the field format_version does not exsists, i assume that it is the problems.
Whenever i try to access the intergration tab, that error appear on the logs.

When i do the upgrade i did not change anything, only after the error appear i change the config to point the registry server to local one.

Can i share the log related to the fleet server only since there is a ton of logs relating to other thing in kibana as well.

7

So now your kibana instance can connect to a local EPR running under the 8.8.1 version but It was not working with the official epr.elastic.co right? Have you got the kibana logs with this error?

8

Hi, can you also clarify the following:

Interestingly when i access the intergration using the url i can still use them like normal.

What exactly do you mean by this? Can you provide details about what you did and the outcome?

9

i access the integration through its url /app/integrations/detail/nginx-1.15.0/policies
after that i can still update, install, reinstall, uninstall, add it to policies, just like normal.
But i cannot view it through the integration panel in kibana.

10

Let me clarify what i said, both onprem and official epr.elatic.co not work for me.
i still give me the not connected to elastic package registry.
The only error i get when i access the integration page is this:

Invalid top-level package manifest: one or more fields missing of name, version, description, title, format_version, owner
11

So to be extra clear:

  • You can access e.g. app/integrations/detail/nginx-1.15.0/overview in the browser and install the integration using the UI, correct?
  • You cannot access app/integrations/browse in the browser, rather you see the "Kibana cannot connect to the Elastic Package Registry, which provides Elastic Agent integrations" error message in the UI, correct?
12

Yes that is the current problems

13

Thanks for confirming. Can you please also confirm the following:

About this error:

Invalid top-level package manifest: one or more fields missing of name, version, description, title, format_version, owner" error

Does this error show up in Kibana logs whenever you try to load the page at app/integrations/browse in the browser, i.e. it matches the other error you see in the UI? Or are they not exactly correlated? I believe this was @ruflin was asking above:

When exactly do you see the error? If you go to the Fleet page or the integrations page?

Also, have you identified the specific request that fails on loading app/integrations/browse (e.g. from the Network tab in the browser)?

14

The error appear exactly when i use the app/integrations/browse in the browser.

In the network tab i check that the request from /api/fleet/epm/packages return 400 code and thí:

{
    "statusCode": 400,
    "error": "Bad Request",
    "message": "Invalid top-level package manifest: one or more fields missing of name, version, description, title, format_version, owner"
}
15

Do you still see the error with all integrations uninstalled?

To make sure, you can check that there are no installed packages by running the query

GET .kibana_ingest/_search?q=type:epm-packages

which will list installed packages. It would be good to confirm that the issue persist if there are no installed packages.

Can you also confirm whether you had or still have Endpoint (Elastic Defend) installed?

Finally, assuming the error does not happen with no installed packages, can you list your installed packages to see if we can track the issue to a specific package?

Thanks

16

your query is a live saver for me,
apparently there is a integration call cyberark that is no longer available on the new registry and is installed in my elastic.
After uninstall it the intergration run fine without any other issue.

Thanks all for your support

17

Fantastic, thanks for confirming!

I made a small change to the server error message to report the package name in the future.

18

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.