Reinstall Fleet Integrations

Elastic Stack Kibana
1

Elastic/Kibana 7.14.1

How do you forcibly reinstall a system integration?

System integration is missing several dashboards and searches so the easy was for most would be to just uninstall reinstall it. Due to system not having the option even after removing it from all policies makes it rather difficult. Using the current version 1.1.2.

POST /api/fleet/epm/packages/system-1.1.2
{ "force": true }

Fails to do anything with the results of:

{
"error" : "no handler found for uri [/api/fleet/epm/packages/system-1.1.2?pretty=true] and method [POST]"
}

Issues with integration example:

FleetSystemMissingOptions
FleetSystemMissingOptions785×1053 54 KB

How would you force the objects to be reloaded?

2

Hi maybe the doc is not super clear about that but the API request here need to be done against Kibana not Elasticsearch

something like this

curl -X POST -u $ES_USER:$ES_PASSWORD https://$KIBANA_URL/api/fleet/epm/packages/system-1.1.2 -H 'kbn-xsrf: xyz'
3

No change even after running curl. Restarting Kibana and clearing browser cache. The count is interesting on dashboard it says 15 which is expected but they are not present even after.

Checking in saved objects shows nothing has been added. Comparing to a cluster that has all dashboards for example [[System Windows Security] Group Management Events - Simple Metrics] is present on the working and using it as a test one.

4

My bad I did not put the force flag in the curl request, Did you try the request against Kibana with the force flag?

5

With revoke:true =
{"statusCode":400,"error":"Bad Request","message":"[request body]: types that failed validation:\n- [request body.0.revoke]: definition for this key is missing\n- [request body.1]: expected value to equal [null]"}

Dropping the "revoke":true worked. All default dashboards, visualizations, searches are not accounted for. Thank you @nchaulet

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.