onPreFetchPhase listener [org.elasticsearch.xpack.security.authz.SecuritySearchOperationListener@X] failed

[alexus]

Hello World!

I'm using Elastic Stack 6.8.12 and running into following issue:

elasticsearch' logs:

XXXX | [2020-10-05T00:22:46,990][WARN ][o.e.i.s.IndexShard ] [XXXXX] [4] onPreFetchPhase listener [org.elasticsearch.xpack.security.authz.SecuritySearchOperationListener@50e79b24] failed
XXXX | org.elasticsearch.ElasticsearchSecurityException: [406] expected scroll indices access control

I cut line as it's extremely long (~5000 characters long).

I get numerous lines, one after another to the point where I run out of space (due to excessive logs).

Please advise.

[alexus]

as the "band aid" solution, one can turn off logging completely ...

[Albert_Zaharovits]

@alexus The culprit is an annoying buggy consistency check. In 6.8.12 you can safely turn that logger off , eg:

PUT /_cluster/settings
{
"persistent": {
"logger.org.elasticsearch.xpack.security.authz.SecuritySearchOperrationListener": "off"
}
}

More options about logger configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/logging.html

Alternatively you can upgrade to 6.8.13 where this issue is fixed altogether and no logging configuration is necessary.

[alexus]

Thank you! I confirm in 6.8.13 issue is resolved!