No Default Index Pattern after update

Robert Burghdoff

unread,

Aug 29, 2018, 9:46:31 AM8/29/18

to security-onion

Ran sudo soup and all went well. In Kibana getting the "No default index pattern". I selected *:logstash-* and hit the start to set as default, and got this error:

Config: Request failed with status code: 403

I also attempted to create an index pattern and got the same error.

Ran the command:
sudo so-elastic-configure-kibana

Wes Lambert

unread,

Aug 29, 2018, 10:04:07 AM8/29/18

to securit...@googlegroups.com

Hi Robert,

What is the result of the following?

From master node:

curl localhost:9200/.kibana/_settings

You may also want to see:

https://discuss.elastic.co/t/forbidden-12-index-read-only-allow-delete-api/110282/5

https://github.com/elastic/kibana/issues/20031

Thanks,

Wes

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

--

https://twitter.com/therealwlambert

https://securityonion.net/

Robert Burghdoff

unread,

Aug 29, 2018, 10:16:53 AM8/29/18

to security-onion

Output from curl localhost:9200/.kibana/_settings

{".kibana":{"settings":{"index":{"number_of_shards":"1","auto_expand_replicas":"0-1","blocks":{"read_only_allow_delete":"true"},"provided_name":".kibana","creation_date":"1524161953154","number_of_replicas":"0","uuid":"EZzWH8ObQm6CQ50Az_LfGQ","version":{"created":"6020399","upgraded":"6030299"}}}}}

Robert Burghdoff

unread,

Aug 29, 2018, 10:30:46 AM8/29/18

to security-onion

I might have fixed this by:
Going to Dev Tools and put this in the console and execute:

PUT _settings
{
"index": {
"blocks": {
"read_only_allow_delete": "false"
}
}
}

PUT :logstash-
{
"index": {
"blocks": {
"read_only_allow_delete": "false"
}
}
}

Then I was able to go into the index patterns and select *:logstash-* as the default.

Max S.

unread,

Sep 3, 2018, 12:34:32 PM9/3/18

to security-onion

I just want to mention here that I was having the same issue, but running the short scripts as you've stated above resolved my Kibana's issues as well.

Thanks Robert and Wes.

bobby.digit...@gmail.com

unread,

Sep 4, 2018, 1:41:32 AM9/4/18

to security-onion

Hey all,

I'm struggling with the same type of errors post "sudo soup".
Is there anything i could mod before conducting the upgrade??
I'm currently trying to same upgrade with double the free space on the main file system.

Let me know,
Cheers,
Bobby

bobby.digit...@gmail.com

unread,

Sep 4, 2018, 2:37:43 AM9/4/18

to security-onion

>
> Hey all,
>
> I'm struggling with the same type of errors post "sudo soup".
> Is there anything i could mod before conducting the upgrade??
> I'm currently trying to same upgrade with double the free space on the main file system.
>
> Let me know,
> Cheers,
> Bobby

Just fixed my issue with this curl command on the seconion host SSH console:

curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'

and got this

{"acknowledged":true}

And Kibana now works

Josh

unread,

Oct 31, 2018, 3:01:06 PM10/31/18

to security-onion

On Tuesday, September 4, 2018 at 1:37:43 AM UTC-5, bobby.digit...@gmail.com wrote:
> Just fixed my issue with this curl command on the seconion host SSH console:
>
> curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'
>
> and got this
>
> {"acknowledged":true}
>
> And Kibana now works

Bobby.Digit, thanks! Your suggestion fixed my Kibana too.

--Josh

Gabriel Sofian

unread,

Nov 15, 2018, 6:55:28 AM11/15/18

to security-onion

Thanks, Bobby.digit, your suggestion fixed my Kibana too!

I was able to go into the index patterns and select *:logstash-* as the default.

Gabriel

Christopher Lowson

unread,

Nov 21, 2018, 8:20:53 PM11/21/18

to security-onion

> curl -XPUT -H "Content-Type: application/json" http://localhost:9200/_all/_settings -d '{"index.blocks.read_only_allow_delete": null}'