Pushing auto-follow-pattern results in a Null pointer exception on elasticsearch side

[kley (Juergen Stuermer)]

Hi guys!
So, we installed elasticsearch 6.8.1 on 6 nodes and are trying to setup CCR with two clusters - 3 nodes each. License is activated and valid, remote settings are set (seed, nodes and cluster name). But now, somehow when I try to push the autofollow pattern like this

curl -X PUT "localhost:9200/_ccr/auto_follow/AutoFollowerPatterns" -H 'Content-Type: application/json' -d'
{
  "remote_cluster" : "elastic-uswest",
  "leader_index_patterns" :
  [
    "visit*"
  ],
  "follow_index_pattern" : "ccr-{{leader_index}}"
}
'

it results into that response:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "remote_transport_exception",
        "reason" : "[10.176.70.184][10.176.70.184:9300][cluster:admin/xpack/ccr/auto_follow_pattern/put]"
      }
    ],
    "type" : "null_pointer_exception",
    "reason" : null
  },
  "status" : 500
}

Digging a bit deeper into the logs of elasticsearch, we can see this message:

[2019-07-09T10:10:49,510][WARN ][r.suppressed             ] [10.176.68.180] path: /_ccr/auto_follow/AutoFollowerPatterns, params: {name=AutoFollowerPatterns}
org.elasticsearch.transport.RemoteTransportException: [10.176.69.160][10.176.69.160:9300][cluster:admin/xpack/ccr/auto_follow_pattern/put]
Caused by: java.lang.NullPointerException
        at org.elasticsearch.xpack.ccr.CcrLicenseChecker.hasPrivilegesToFollowIndices(CcrLicenseChecker.java:318) ~[?:?]
        at org.elasticsearch.xpack.ccr.action.TransportPutAutoFollowPatternAction.lambda$masterOperation$2(TransportPutAutoFollowPatternAction.java:88) ~[?:?]
        at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:61) ~[elasticsearch-6.8.1.jar:6.8.1]
        at org.elasticsearch.action.support.ContextPreservingActionListener.onResponse(ContextPreservingActionListener.java:43) ~[elasticsearch-6.8.1.jar:6.8.1]
        at org.elasticsearch.action.ActionListenerResponseHandler.handleResponse(ActionListenerResponseHandler.java:54) ~[elasticsearch-6.8.1.jar:6.8.1]
        at org.elasticsearch.transport.TransportService$ContextRestoreResponseHandler.handleResponse(TransportService.java:1104) ~[elasticsearch-6.8.1.jar:6.8.1]
        at org.elasticsearch.transport.TcpTransport$1.doRun(TcpTransport.java:985) ~[elasticsearch-6.8.1.jar:6.8.1]
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[elasticsearch-6.8.1.jar:6.8.1]
        at org.elasticsearch.common.util.concurrent.EsExecutors$DirectExecutorService.execute(EsExecutors.java:193) ~[elasticsearch-6.8.1.jar:6.8.1]
        at org.elasticsearch.transport.TcpTransport.handleResponse(TcpTransport.java:977) [elasticsearch-6.8.1.jar:6.8.1]
        at org.elasticsearch.transport.TcpTransport.messageReceived(TcpTransport.java:952) [elasticsearch-6.8.1.jar:6.8.1]
        at org.elasticsearch.transport.TcpTransport.inboundMessage(TcpTransport.java:763) [elasticsearch-6.8.1.jar:6.8.1]
...

Our initial thought was, that the security module could cause the error - because of this word in the exception: hasPrivilegesToFollowIndices. So, we removed all unnecessary modules and the error still occurs.

The installed modules are those:

Any ideas on what the root cause can be ?
Thanks in advance

[DavidTurner]

@kley

Caused by: java.lang.NullPointerException

A NullPointerException here is a bug. Could you open a Github issue please?

[kley (Juergen Stuermer)]

Thank you for your response. Created a bug report https://github.com/elastic/elasticsearch/issues/44172.

One more thing, I cannot get another cluster in this state, its only this one though