You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I get a 400 error executing a kibana /_flush api call from dev console citing "reason" : "Data stream(s) [.fleet-actions-results] use and access is reserved for system operations"
#426
Closed
EricDavisX opened this issue
Jun 3, 2021
· 2 comments
I dont know the API well, but if users will run into this due to permissions problems I wanted to log it to help figure out what we need to change and how it cane be supported in 7.13 / 7.14 (and 8.0 internal usage) in the mean time. I found this against our kibana.siem server, which is currently 8.0 based and has fairly recent code (the ES instance may actually be a little older than the current Kibana hash, which for all I know is part of the problem and we just need to blow it away?) any help from Fleet-Server side is appreciated.
check #fleet-server slack for more details, pls - or ping sec engg prod team.
POST /_flush
{
"error" : {
"root_cause" : [
{
"type" : "illegal_argument_exception",
"reason" : "Data stream(s) [.fleet-actions-results] use and access is reserved for system operations"
}
],
"type" : "illegal_argument_exception",
"reason" : "Data stream(s) [.fleet-actions-results] use and access is reserved for system operations"
},
"status" : 400
}
The text was updated successfully, but these errors were encountered:
Dan Pan suggested I can work-around this by passing the Kibana header in that relates to the above issue (enh?) I logged.
'X-elastic-product-origin: kibana'
So, I'm not thinking this is a Fleet Server bug anymore. If nobody complains I suggest we close it out.
I dont know the API well, but if users will run into this due to permissions problems I wanted to log it to help figure out what we need to change and how it cane be supported in 7.13 / 7.14 (and 8.0 internal usage) in the mean time. I found this against our kibana.siem server, which is currently 8.0 based and has fairly recent code (the ES instance may actually be a little older than the current Kibana hash, which for all I know is part of the problem and we just need to blow it away?) any help from Fleet-Server side is appreciated.
check #fleet-server slack for more details, pls - or ping sec engg prod team.
POST /_flush
{
"error" : {
"root_cause" : [
{
"type" : "illegal_argument_exception",
"reason" : "Data stream(s) [.fleet-actions-results] use and access is reserved for system operations"
}
],
"type" : "illegal_argument_exception",
"reason" : "Data stream(s) [.fleet-actions-results] use and access is reserved for system operations"
},
"status" : 400
}
The text was updated successfully, but these errors were encountered: