Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

I get a 400 error executing a kibana /_flush api call from dev console citing "reason" : "Data stream(s) [.fleet-actions-results] use and access is reserved for system operations" #426

Closed
EricDavisX opened this issue Jun 3, 2021 · 2 comments

Comments

@EricDavisX
Copy link
Contributor

I dont know the API well, but if users will run into this due to permissions problems I wanted to log it to help figure out what we need to change and how it cane be supported in 7.13 / 7.14 (and 8.0 internal usage) in the mean time. I found this against our kibana.siem server, which is currently 8.0 based and has fairly recent code (the ES instance may actually be a little older than the current Kibana hash, which for all I know is part of the problem and we just need to blow it away?) any help from Fleet-Server side is appreciated.

check #fleet-server slack for more details, pls - or ping sec engg prod team.

POST /_flush
{
"error" : {
"root_cause" : [
{
"type" : "illegal_argument_exception",
"reason" : "Data stream(s) [.fleet-actions-results] use and access is reserved for system operations"
}
],
"type" : "illegal_argument_exception",
"reason" : "Data stream(s) [.fleet-actions-results] use and access is reserved for system operations"
},
"status" : 400
}

@EricDavisX
Copy link
Contributor Author

Dan Pan suggested I can work-around this by passing the Kibana header in that relates to the above issue (enh?) I logged.
'X-elastic-product-origin: kibana'

So, I'm not thinking this is a Fleet Server bug anymore. If nobody complains I suggest we close it out.

@EricDavisX
Copy link
Contributor Author

@ruflin fyi.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant