Error while deleting expired entries from .searchguard_resource_owner

Search Guard
1

Please let us know what does below log means and why this exception is seen.
Is this any impact on cluster for below error.
What is .searchguard_resource_owner index does.

Elasticsearch version:

Server OS version:

Kibana version (if relevant):

Browser version (if relevant):

Browser OS version (if relevant):

Describe the issue:

Steps to reproduce:
1.
2.
3.

Expected behavior:

Provide configuration:
elasticsearch/config/elasticsearch.yml
elasticsearch/plugins/search-guard-7/sgconfig/sg_config.yml
kibana/config/kibana.yml (if relevant)

Provide logs:
Elasticsearch
Kibana (if relevant)

{"type":"log","host":"nsmc-elasticsearch-master-0","level":"ERROR","systemid":"2106a117733f42d697284fbc54927928","system":"BELK","time": "2020-11-25T05:56:27.580Z","logger":"c.f.s.p.e.ResourceOwnerService","timezone":"UTC","marker":"[nsmc-elasticsearch-master-0] ","log":{"message":"Error while deleting expired entries from .searchguard_resource_owner"}}
org.elasticsearch.index.IndexNotFoundException: no such index [.searchguard_resource_owner]
        at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver$WildcardExpressionResolver.indexNotFoundException(IndexNameExpressionResolver.java:840) ~[elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver$WildcardExpressionResolver.innerResolve(IndexNameExpressionResolver.java:777) ~[elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver$WildcardExpressionResolver.resolve(IndexNameExpressionResolver.java:733) ~[elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:178) ~[elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:153) ~[elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.search.TransportSearchAction.resolveLocalIndices(TransportSearchAction.java:460) ~[elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.search.TransportSearchAction.executeSearch(TransportSearchAction.java:474) ~[elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.search.TransportSearchAction.executeLocalSearch(TransportSearchAction.java:403) ~[elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.search.TransportSearchAction.lambda$doExecute$3(TransportSearchAction.java:213) ~[elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:63) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.query.Rewriteable.rewriteAndFetch(Rewriteable.java:114) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.query.Rewriteable.rewriteAndFetch(Rewriteable.java:87) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.search.TransportSearchAction.doExecute(TransportSearchAction.java:244) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.search.TransportSearchAction.doExecute(TransportSearchAction.java:88) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:179) [elasticsearch-7.8.0.jar:7.8.0]
        at com.floragunn.searchguard.filter.SearchGuardFilter.apply0(SearchGuardFilter.java:204) [search-guard-suite-security-7.8.0-43.0.0-146.jar:7.8.0-43.0.0-146]
        at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:119) [search-guard-suite-security-7.8.0-43.0.0-146.jar:7.8.0-43.0.0-146]
        at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:177) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:155) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:83) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.node.NodeClient.executeLocally(NodeClient.java:83) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.node.NodeClient.doExecute(NodeClient.java:72) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:399) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.FilterClient.doExecute(FilterClient.java:65) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.ParentTaskAssigningClient.doExecute(ParentTaskAssigningClient.java:63) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:399) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.support.AbstractClient.search(AbstractClient.java:532) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.ClientScrollableHitSource.doStart(ClientScrollableHitSource.java:77) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.ScrollableHitSource.start(ScrollableHitSource.java:78) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.AbstractAsyncBulkByScrollAction.start(AbstractAsyncBulkByScrollAction.java:242) [reindex-client-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.TransportDeleteByQueryAction.lambda$doExecute$0(TransportDeleteByQueryAction.java:63) [reindex-client-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.BulkByScrollParallelizationHelper.executeSlicedAction(BulkByScrollParallelizationHelper.java:105) [reindex-client-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.BulkByScrollParallelizationHelper$1.onResponse(BulkByScrollParallelizationHelper.java:74) [reindex-client-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.BulkByScrollParallelizationHelper$1.onResponse(BulkByScrollParallelizationHelper.java:71) [reindex-client-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.BulkByScrollParallelizationHelper.initTaskState(BulkByScrollParallelizationHelper.java:142) [reindex-client-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.BulkByScrollParallelizationHelper.startSlicedAction(BulkByScrollParallelizationHelper.java:71) [reindex-client-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.TransportDeleteByQueryAction.doExecute(TransportDeleteByQueryAction.java:57) [reindex-client-7.8.0.jar:7.8.0]
        at org.elasticsearch.index.reindex.TransportDeleteByQueryAction.doExecute(TransportDeleteByQueryAction.java:36) [reindex-client-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:179) [elasticsearch-7.8.0.jar:7.8.0]
        at com.floragunn.searchguard.filter.SearchGuardFilter.apply0(SearchGuardFilter.java:204) [search-guard-suite-security-7.8.0-43.0.0-146.jar:7.8.0-43.0.0-146]
        at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:119) [search-guard-suite-security-7.8.0-43.0.0-146.jar:7.8.0-43.0.0-146]
        at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:177) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:155) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:83) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.node.NodeClient.executeLocally(NodeClient.java:83) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.node.NodeClient.doExecute(NodeClient.java:72) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:399) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.client.FilterClient.doExecute(FilterClient.java:65) [elasticsearch-7.8.0.jar:7.8.0]
        at com.floragunn.searchsupport.client.ContextHeaderDecoratorClient.doExecute(ContextHeaderDecoratorClient.java:38) [search-guard-suite-support-7.8.0-43.0.0.jar:7.8.0-43.0.0]
        at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:399) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.action.ActionRequestBuilder.execute(ActionRequestBuilder.java:70) [elasticsearch-7.8.0.jar:7.8.0]
        at com.floragunn.searchguard.privileges.extended_action_handling.ResourceOwnerService.cleanupExpiredEntries(ResourceOwnerService.java:303) [search-guard-suite-security-7.8.0-43.0.0-146.jar:7.8.0-43.0.0-146]
        at com.floragunn.searchguard.privileges.extended_action_handling.ResourceOwnerService.access$1000(ResourceOwnerService.java:43) [search-guard-suite-security-7.8.0-43.0.0-146.jar:7.8.0-43.0.0-146]
        at com.floragunn.searchguard.privileges.extended_action_handling.ResourceOwnerService$6.lambda$clusterChanged$0(ResourceOwnerService.java:333) [search-guard-suite-security-7.8.0-43.0.0-146.jar:7.8.0-43.0.0-146]
        at org.elasticsearch.threadpool.Scheduler$ReschedulingRunnable.doRun(Scheduler.java:213) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:695) [elasticsearch-7.8.0.jar:7.8.0]
        at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-7.8.0.jar:7.8.0]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]
        at java.lang.Thread.run(Thread.java:834) [?:?]

Screenshots (if relevant):

Errors in browser console (if relevant):

Additional data:

2

Hello!

It would have been helpful if you would have provided the Search Guard version you are using.

The index searchguard_resource_owner is internally used by Search Guard to store owner information for async searches. It is no problem if the index does not exist; thus just means that you did not use the specific APIs so far.

The log message appeared only for Search Guard versions 43 and 45. Beginning with version 46, the message does no longer appear as error in the logs.

1 Like
3

SearchGuard Version is 7.8.0-43.0.0.

4

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.