Upgrade from 7.x to 8.4.1

[Ravi_S1 (Ravi S)]

After upgrade from 7.7.1 to 8.4.1, Kibana 8.4.1 is showing down.. "{"statusCode":503,"error":"Service Unavailable","message":"[No shard available for [get [.kibana_8.4.1][space:default]: routing [null]]: no_shard_available_action_exception: [no_shard_available_action_exception] Reason: No shard available for [get [.kibana_8.4.1][space:default]: routing [null]]]: No shard available for [get [.kibana_8.4.1][space:default]: routing [null]]"}"

To bring this up, i used to use close this system indices and restore using snapshot. Now, i can't close this indices due to following error message...using the elastic credential..

{
"error" : {
"root_cause" : [
{
"type" : "security_exception",
"reason" : "action [indices:admin/close] is unauthorized for user [elastic] with roles [superuser] on restricted indices [.kibana_8.4.1_001], this action is granted by the index privileges [manage_follow_index,manage,all]"
}
],
"type" : "security_exception",
"reason" : "action [indices:admin/close] is unauthorized for user [elastic] with roles [superuser] on restricted indices [.kibana_8.4.1_001], this action is granted by the index privileges [manage_follow_index,manage,all]"
},
"status" : 403
}

Please help me to fix this issue...

[rt_888]

The xpack security is not enabled anymore on version 8.x . You should update from 7.7.1 to 7.17.0 before major upgrade to version 8 and use the update assistance tool

[stephenb (Stephen Brown)]

Hi @Ravi_S1

1st I agree with the previous user you should have upgrade to 7.17.x first and used the upgrade assistant. You can not really downgrade unless you can restore and start over. If you can that might be the best path...

A lot has changed in 8.x including restricting access to system indices that start with . like .kibana_xxx

You actually have to create a role that allows access to restricted indices if you want to operate on them see here I wrote a little post on that

All that said I am not sure of closing that index and restoring a past version is going to work... It seems you have no where to put that shard.

[Ravi_S1 (Ravi S)]

Thank you for this support... My apologies to says that for wrongly mentioned about our previous version..our previous version was 7.17.1.. we upgraded 7.17.1 to 8.4.1 release...i hope that this works.. following are current permissions...

{
  "cluster" : [
    "all"
  ],
  "global" : [ ],
  "indices" : [
    {
      "names" : [
        "*"
      ],
      "privileges" : [
        "all"
      ],
      "allow_restricted_indices" : false
    },
    {
      "names" : [
        "*"
      ],
      "privileges" : [
        "monitor",
        "read",
        "read_cross_cluster",
        "view_index_metadata"
      ],
      "allow_restricted_indices" : true
    }
  ],
  "applications" : [
    {
      "application" : "*",
      "privileges" : [
        "*"
      ],
      "resources" : [
        "*"
      ]
    }
  ],
  "run_as" : [
    "*"
  ]
}