Watcher: Error 500 Internal Server Error

Elastic Stack Elasticsearch
1

Upgraded 5.6 to 6.1.0 with x-pack trial. When I click on watcher, I am receiving a 500 error. I see a mismatch in the logstashwatcher section, but I am not sure how to resolve it or what is mismatched. Checked versions:

[fmatera@elktest1 logstash]$ sudo /usr/share/logstash/bin/logstash --version
logstash 6.1.0
[fmatera@elktest1 logstash]$ sudo /usr/share/kibana/bin/kibana --version
6.1.0
[fmatera@elktest1 logstash]$ sudo /usr/share/elasticsearch/bin/elasticsearch --version
Version: 6.1.0, Build: c0c1ba0/2017-12-12T12:32:54.550Z, JVM: 1.8.0_141
[fmatera@elktest1 logstash]$ sudo /usr/share/filebeat/bin/filebeat --version
filebeat version 6.1.0 (amd64), libbeat 6.1.0

And

GET .watches/_search/

   {
      "took": 0,
      "timed_out": false,
      "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
      },
      "hits": {
        "total": 4,
        "max_score": 1,
        "hits": [
          {
            "_index": ".watches",
            "_type": "watch",
            "_id": "w5LeijeZRliWA-0ZKeUBOA_logstash_version_mismatch",
            "_score": 1,
            "_source": {
              "trigger": {
                "schedule": {
                  "interval": "1m"
                }
              },
              "input": {
                "chain": {
                  "inputs": [
                    {
                      "check": {
                        "search": {
                          "request": {
                            "search_type": "query_then_fetch",
                            "indices": [
                              ".monitoring-logstash-*"
                            ],
                            "types": [],
                            "body": {
                              "size": 0,
                              "query": {
                                "bool": {
                                  "filter": [
                                    {
                                      "term": {
                                        "cluster_uuid": "{{ctx.metadata.xpack.cluster_uuid}}"
                                      }
                                    },
                                    {
                                      "range": {
                                        "timestamp": {
                                          "gte": "now-2m"
                                        }
                                      }
                                    },
                                    {
                                      "bool": {
                                        "should": [
                                          {
                                            "term": {
                                              "_type": "logstash_stats"
                                            }
                                          },
                                          {
                                            "term": {
                                              "type": "logstash_stats"
                                            }
                                          }
                                        ]
                                      }
                                    }
                                  ]
                                }
                              },
                              "aggs": {
                                "group_by_logstash": {
                                  "terms": {
                                    "field": "logstash_stats.logstash.uuid",
                                    "size": 1000
                                  },
                                  "aggs": {
                                    "group_by_version": {
                                      "terms": {
                                        "field": "logstash_stats.logstash.version",
                                        "size": 1,
                                        "order": {
                                          "latest_report": "desc"
                                        }
                                      },
                                      "aggs": {
                                        "latest_report": {
                                          "max": {
                                            "field": "timestamp"
                                          }
                                        }
                                      }
                                    }
                                  }
                                }
                              }
                            }
                          }
                        }
                      }
                    },
                    {
                      "alert": {
                        "search": {
                          "request": {
                            "search_type": "query_then_fetch",
                            "indices": [
                              ".monitoring-alerts-6",
                              ".monitoring-alerts-2"
                            ],
                            "types": [],
                            "body": {
                              "size": 1,
                              "terminate_after": 1,
                              "query": {
                                "bool": {
                                  "filter": {
                                    "term": {
                                      "_id": "{{ctx.watch_id}}"
                                    }
                                  }
                                }
                              },
                              "sort": [
                                {
                                  "timestamp": {
                                    "order": "desc"
                                  }
                                }
                              ]
                            }
                          }
                        }
                      }
                    }
                  ]
                }
              },

Thanks in advance. Couldn't fit the response in one post.

2 
     "condition": {
        "script": {
          "source": "ctx.vars.fails_check = false;if (ctx.payload.check.hits.total != 0 && ctx.payload.check.aggregations.group_by_logstash.buckets.size() > 1) {def versions = new HashSet();for (def logstash : ctx.payload.check.aggregations.group_by_logstash.buckets) {if (logstash.group_by_version.buckets.size() != 0) {versions.add(logstash.group_by_version.buckets[0].key);}}if (versions.size() > 1) {ctx.vars.fails_check = true;ctx.vars.versions = new ArrayList(versions);Collections.sort(ctx.vars.versions);}}ctx.vars.not_resolved = ctx.payload.alert.hits.total == 1 && ctx.payload.alert.hits.hits[0]._source.resolved_timestamp == null;return ctx.vars.fails_check || ctx.vars.not_resolved;",
          "lang": "painless"
        }
      },
      "transform": {
        "script": {
          "source": "def versionMessage = null;if (ctx.vars.fails_check) {versionMessage = 'Versions: [' + String.join(', ', ctx.vars.versions) + '].';}if (ctx.vars.not_resolved) {ctx.payload = ctx.payload.alert.hits.hits[0]._source;if (ctx.vars.fails_check) {ctx.payload.message = versionMessage;} else {ctx.payload.resolved_timestamp = ctx.execution_time;}} else {ctx.payload = [ 'timestamp': ctx.execution_time, 'prefix': 'This cluster is running with multiple versions of Logstash.', 'message': versionMessage, 'metadata': ctx.metadata.xpack ];}ctx.payload.update_timestamp = ctx.execution_time;return ctx.payload;",
          "lang": "painless"
        }
      },
      "actions": {
        "trigger_alert": {
          "index": {
            "index": ".monitoring-alerts-6",
            "doc_type": "doc",
            "doc_id": "w5LeijeZRliWA-0ZKeUBOA_logstash_version_mismatch"
          }
        }
      },
      "metadata": {
        "name": "X-Pack Monitoring: Logstash Version Mismatch (w5LeijeZRliWA-0ZKeUBOA)",
        "xpack": {
          "severity": 1000,
          "cluster_uuid": "w5LeijeZRliWA-0ZKeUBOA",
          "version_created": 5050199,
          "watch": "logstash_version_mismatch",
          "link": "logstash/instances",
          "alert_index": ".monitoring-alerts-6",
          "type": "monitoring"
        }
      },
      "_status": {
        "state": {
          "active": true,
          "timestamp": "2017-11-29T12:54:20.352Z"
        },
        "actions": {
          "trigger_alert": {
            "ack": {
              "timestamp": "2017-11-29T12:54:20.352Z",
              "state": "awaits_successful_execution"
            }
          }
        },
        "last_checked": "2017-11-29T14:07:16.681Z"
      }
    }
  },
  {
    "_index": ".watches",
    "_type": "watch",
    "_id": "w5LeijeZRliWA-0ZKeUBOA_elasticsearch_version_mismatch",
    "_score": 1,
    "_source": {
      "trigger": {
        "schedule": {
          "interval": "1m"
        }
      },
      "input": {
        "chain": {
          "inputs": [
            {
              "check": {
                "search": {
                  "request": {
                    "search_type": "query_then_fetch",
                    "indices": [
                      ".monitoring-es-*"
                    ],
                    "types": [],
                    "body": {
                      "size": 1,
                      "_source": [
                        "cluster_stats.nodes.versions"
                      ],
                      "query": {
                        "bool": {
                          "filter": [
                            {
                              "term": {
                                "_id": "{{ctx.metadata.xpack.cluster_uuid}}"
                              }
                            },
                            {
                              "bool": {
                                "should": [
                                  {
                                    "term": {
                                      "_type": "cluster_stats"
                                    }
                                  },
                                  {
                                    "term": {
                                      "type": "cluster_stats"
                                    }
                                  }
                                ]
                              }
                            }
                          ]
                        }
                      },
                      "sort": [
                        {
                          "timestamp": {
                            "order": "desc"
                          }
                        }
                      ]
                    }
                  }
                }
              }
            },
            {
3 
              "alert": {
                "search": {
                  "request": {
                    "search_type": "query_then_fetch",
                    "indices": [
                      ".monitoring-alerts-6",
                      ".monitoring-alerts-2"
                    ],
                    "types": [],
                    "body": {
                      "size": 1,
                      "terminate_after": 1,
                      "query": {
                        "bool": {
                          "filter": {
                            "term": {
                              "_id": "{{ctx.watch_id}}"
                            }
                          }
                        }
                      },
                      "sort": [
                        {
                          "timestamp": {
                            "order": "desc"
                          }
                        }
                      ]
                    }
                  }
                }
              }
            }
          ]
        }
      },
      "condition": {
        "script": {
          "source": "ctx.vars.fails_check = ctx.payload.check.hits.total != 0 && ctx.payload.check.hits.hits[0]._source.cluster_stats.nodes.versions.size() != 1;ctx.vars.not_resolved = ctx.payload.alert.hits.total == 1 && ctx.payload.alert.hits.hits[0]._source.resolved_timestamp == null;return ctx.vars.fails_check || ctx.vars.not_resolved;",
          "lang": "painless"
        }
      },
      "transform": {
        "script": {
          "source": "def versionMessage = null;if (ctx.vars.fails_check) {def versions = new ArrayList(ctx.payload.check.hits.hits[0]._source.cluster_stats.nodes.versions);Collections.sort(versions);versionMessage = 'Versions: [' + String.join(', ', versions) + '].';}if (ctx.vars.not_resolved) {ctx.payload = ctx.payload.alert.hits.hits[0]._source;if (ctx.vars.fails_check) {ctx.payload.message = versionMessage;} else {ctx.payload.resolved_timestamp = ctx.execution_time;}} else {ctx.payload = [ 'timestamp': ctx.execution_time, 'prefix': 'This cluster is running with multiple versions of Elasticsearch.', 'message': versionMessage, 'metadata': ctx.metadata.xpack ];}ctx.payload.update_timestamp = ctx.execution_time;return ctx.payload;",
          "lang": "painless"
        }
      },
      "actions": {
        "trigger_alert": {
          "index": {
            "index": ".monitoring-alerts-6",
            "doc_type": "doc",
            "doc_id": "w5LeijeZRliWA-0ZKeUBOA_elasticsearch_version_mismatch"
          }
        }
      },
      "metadata": {
        "name": "X-Pack Monitoring: Elasticsearch Version Mismatch (w5LeijeZRliWA-0ZKeUBOA)",
        "xpack": {
          "severity": 1000,
          "cluster_uuid": "w5LeijeZRliWA-0ZKeUBOA",
          "version_created": 5050199,
          "watch": "elasticsearch_version_mismatch",
          "link": "elasticsearch/nodes",
          "alert_index": ".monitoring-alerts-6",
          "type": "monitoring"
        }
      },
      "_status": {
        "state": {
          "active": true,
          "timestamp": "2017-11-29T12:54:20.349Z"
        },
        "actions": {
          "trigger_alert": {
            "ack": {
              "timestamp": "2017-11-29T12:54:20.349Z",
              "state": "awaits_successful_execution"
            }
          }
        },
        "last_checked": "2017-11-29T14:07:16.681Z"
      }
    }
  },
  {
    "_index": ".watches",
    "_type": "watch",
    "_id": "w5LeijeZRliWA-0ZKeUBOA_elasticsearch_cluster_status",
    "_score": 1,
    "_source": {
      "trigger": {
        "schedule": {
          "interval": "1m"
        }
      },
      "input": {
        "chain": {
          "inputs": [
            {
              "check": {
                "search": {
                  "request": {
                    "search_type": "query_then_fetch",
                    "indices": [
                      ".monitoring-es-*"
                    ],
                    "types": [],
                    "body": {
                      "size": 1,
                      "sort": [
                        {
                          "timestamp": {
                            "order": "desc"
                          }
                        }
                      ],
                      "_source": [
                        "cluster_state.status"
                      ],
                      "query": {
                        "bool": {
                          "filter": [
                            {
                              "term": {
                                "cluster_uuid": "{{ctx.metadata.xpack.cluster_uuid}}"
                              }
                            },
                            {
                              "bool": {
                                "should": [
                                  {
                                    "term": {
                                      "_type": "cluster_state"
                                    }
                                  },
                                  {
                                    "term": {
                                      "type": "cluster_stats"
                                    }
                                  }
                                ]
                              }
                            }
                          ]
                        }
                      }
                    }
                  }
                }
              }
            },
            {
4

Hey @Frank_Matera are you getting a 500 when you try to view your Watches via Kibana? If so, can you check your Kibana log files to see if a specific error is logged?

5

Yes I am. Here are the logs, not sure I understand:

{"type":"response","@timestamp":"2018-01-15T12:38:13Z","tags":[],"pid":9726,"method":"get","statusCode":200,"req":{"url":"/api/security/v1/me","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","accept":"application/json, text/plain, */*","kbn-version":"6.1.0","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":200,"responseTime":7,"contentLength":9},"message":"GET /api/security/v1/me 200 7ms - 9.0B"}
{"type":"response","@timestamp":"2018-01-15T12:38:13Z","tags":[],"pid":9726,"method":"get","statusCode":200,"req":{"url":"/api/security/v1/me","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","accept":"application/json, text/plain, */*","kbn-version":"6.1.0","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":200,"responseTime":12,"contentLength":9},"message":"GET /api/security/v1/me 200 12ms - 9.0B"}
{"type":"response","@timestamp":"2018-01-15T12:38:13Z","tags":[],"pid":9726,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-32x32.png","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","accept":"image/webp,image/apng,image/*,*/*;q=0.8","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"8e183c2e644fb050707d89402e1f7a120a95e4d2\"","if-modified-since":"Tue, 12 Dec 2017 12:42:38 GMT"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":304,"responseTime":3,"contentLength":9},"message":"GET /ui/favicons/favicon-32x32.png 304 3ms - 9.0B"}
{"type":"error","@timestamp":"2018-01-15T12:38:13Z","tags":[],"pid":9726,"level":"error","error":{"message":"json argument must contain a watchStatusJson property","name":"Error","stack":"Error: json argument must contain a watchStatusJson property\n    at Function.getPropsFromUpstreamJson (/usr/share/kibana/plugins/x-pack/plugins/watcher/server/models/watch/base_watch.js:90:13)\n    at Function.fromUpstreamJson (/usr/share/kibana/plugins/x-pack/plugins/watcher/server/models/watch/monitoring_watch.js:51:13)\n    at Function.fromUpstreamJson (/usr/share/kibana/plugins/x-pack/plugins/watcher/server/models/watch/watch.js:41:22)\n    at hits.map.hit (/usr/share/kibana/plugins/x-pack/plugins/watcher/server/routes/api/watches/register_list_route.js:41:24)\n    at Array.map (native)\n    at fetchWatches.then.hits (/usr/share/kibana/plugins/x-pack/plugins/watcher/server/routes/api/watches/register_list_route.js:36:30)\n    at tryCatcher (/usr/share/kibana/node_modules/bluebird/js/main/util.js:26:23)\n    at Promise._settlePromiseFromHandler (/usr/share/kibana/node_modules/bluebird/js/main/promise.js:503:31)\n    at Promise._settlePromiseAt (/usr/share/kibana/node_modules/bluebird/js/main/promise.js:577:18)\n    at Async._drainQueue (/usr/share/kibana/node_modules/bluebird/js/main/async.js:128:12)\n    at Async._drainQueues (/usr/share/kibana/node_modules/bluebird/js/main/async.js:133:10)\n    at Immediate.Async.drainQueues (/usr/share/kibana/node_modules/bluebird/js/main/async.js:15:14)\n    at runCallback (timers.js:672:20)\n    at tryOnImmediate (timers.js:645:5)\n    at processImmediate [as _immediateCallback] (timers.js:617:5)"},"url":{"protocol":null,"slashes":null,"auth":null,"host":null,"port":null,"hostname":null,"hash":null,"search":"","query":{},"pathname":"/api/watcher/watches","path":"/api/watcher/watches","href":"/api/watcher/watches"},"message":"json argument must contain a watchStatusJson property"}
{"type":"response","@timestamp":"2018-01-15T12:38:13Z","tags":[],"pid":9726,"method":"get","statusCode":500,"req":{"url":"/api/watcher/watches","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","accept":"application/json, text/plain, */*","kbn-version":"6.1.0","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":500,"responseTime":34,"contentLength":9},"message":"GET /api/watcher/watches 500 34ms - 9.0B"}
6 
{"type":"response","@timestamp":"2018-01-15T12:38:13Z","tags":[],"pid":9726,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-32x32.png","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","accept":"image/webp,image/apng,image/*,*/*;q=0.8","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"8e183c2e644fb050707d89402e1f7a120a95e4d2\"","if-modified-since":"Tue, 12 Dec 2017 12:42:38 GMT"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":304,"responseTime":2,"contentLength":9},"message":"GET /ui/favicons/favicon-32x32.png 304 2ms - 9.0B"}
{"type":"response","@timestamp":"2018-01-15T12:38:13Z","tags":[],"pid":9726,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-16x16.png","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","accept":"image/webp,image/apng,image/*,*/*;q=0.8","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"13b869be5df4bdc56920edc16a28e67a7c08203b\"","if-modified-since":"Tue, 12 Dec 2017 12:42:38 GMT"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":304,"responseTime":1,"contentLength":9},"message":"GET /ui/favicons/favicon-16x16.png 304 1ms - 9.0B"}
{"type":"response","@timestamp":"2018-01-15T12:38:13Z","tags":[],"pid":9726,"method":"get","statusCode":200,"req":{"url":"/api/security/v1/me","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","accept":"application/json, text/plain, */*","kbn-version":"6.1.0","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":200,"responseTime":6,"contentLength":9},"message":"GET /api/security/v1/me 200 6ms - 9.0B"}
{"type":"response","@timestamp":"2018-01-15T12:38:13Z","tags":[],"pid":9726,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-32x32.png","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","accept":"image/webp,image/apng,image/*,*/*;q=0.8","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"8e183c2e644fb050707d89402e1f7a120a95e4d2\"","if-modified-since":"Tue, 12 Dec 2017 12:42:38 GMT"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":304,"responseTime":3,"contentLength":9},"message":"GET /ui/favicons/favicon-32x32.png 304 3ms - 9.0B"}
{"type":"response","@timestamp":"2018-01-15T12:38:13Z","tags":[],"pid":9726,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-16x16.png","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","accept":"image/webp,image/apng,image/*,*/*;q=0.8","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"13b869be5df4bdc56920edc16a28e67a7c08203b\"","if-modified-since":"Tue, 12 Dec 2017 12:42:38 GMT"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":304,"responseTime":1,"contentLength":9},"message":"GET /ui/favicons/favicon-16x16.png 304 1ms - 9.0B"}
{"type":"response","@timestamp":"2018-01-15T12:38:14Z","tags":[],"pid":9726,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-32x32.png","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","accept":"image/webp,image/apng,image/*,*/*;q=0.8","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"8e183c2e644fb050707d89402e1f7a120a95e4d2\"","if-modified-since":"Tue, 12 Dec 2017 12:42:38 GMT"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":304,"responseTime":1,"contentLength":9},"message":"GET /ui/favicons/favicon-32x32.png 304 1ms - 9.0B"}
{"type":"response","@timestamp":"2018-01-15T12:38:14Z","tags":[],"pid":9726,"method":"get","statusCode":304,"req":{"url":"/ui/favicons/favicon-16x16.png","method":"get","headers":{"host":"elktest1.idt.net:5601","connection":"keep-alive","user-agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36","accept":"image/webp,image/apng,image/*,*/*;q=0.8","referer":"http://elktest1.idt.net:5601/app/kibana","accept-encoding":"gzip, deflate","accept-language":"en-US,en;q=0.9","if-none-match":"\"13b869be5df4bdc56920edc16a28e67a7c08203b\"","if-modified-since":"Tue, 12 Dec 2017 12:42:38 GMT"},"remoteAddress":"169.132.91.38","userAgent":"169.132.91.38","referer":"http://elktest1.idt.net:5601/app/kibana"},"res":{"statusCode":304,"responseTime":2,"contentLength":9},"message":"GET /ui/favicons/favicon-16x16.png 304 2ms - 9.0B"}
7

@Frank_Matera when you upgraded from 5.6.0, did you use the Upgrade Assistant ?

8

no, x-pack wansn't installed when ELK was upgraded.

9

@Frank_Matera

Can you run this and paste the results?

GET .watches/_settings
GET _template/*watch*

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.