# kibana always create index pattern fail after search guard integrate with k8s **URL:** \ **Category:** Search Guard\ **Created:** [November 27, 2018, 3:50pm UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216 "2018-11-27T15:50:40Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![johnzhengaz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/johnzhengaz/32/622_2.png) [@johnzhengaz](https://forum.search-guard.com/u/johnzhengaz)\ **Post date:** [November 27, 2018, 3:50pm UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/1 "2018-11-27T15:50:40Z")
When I try to create an “Index Patterns”, always fail as below: ![Untitled.png](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/9f211270f7588200019c6d63b1cf3d4e34949a92.png) elastic search log : [2018-11-27T15:46:42,474][INFO][o.e.c.m.MetaDataMappingService] [voROLHr] [searchguard/-1GwoUFQTeaYFWoxGFWKCQ] update\_mapping [sg] [2018-11-27T15:46:42,631][INFO][c.f.s.c.IndexBaseConfigurationRepository] Search Guard License Info: No license needed because enterprise modules are not enabled [2018-11-27T15:47:06,605][INFO][o.e.c.m.MetaDataCreateIndexService] [voROLHr] [logstash-2018.11.27] creating index, cause [auto(bulk api)], templates , shards [5]/[1], mappings [2018-11-27T15:47:06,792][INFO][o.e.c.m.MetaDataMappingService] [voROLHr] [logstash-2018.11.27/AiH27yT9QE-8QATtHGFZqw] create\_mapping [fluentd] [2018-11-27T15:48:11,049][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] [2018-11-27T15:48:12,802][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] [2018-11-27T15:48:12,917][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] [2018-11-27T15:48:13,190][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] [2018-11-27T15:48:13,312][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] [2018-11-27T15:48:13,748][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] kibana UI show error: - Not Found elastic search log _ **Note:** _ Works well for below command: kubectl get pods -n kube-system -l k8s-app=elasticsearch-logging |awk ‘{print $1}’|sed ‘1d’|xargs -i sh -c ‘kubectl exec -ti {} -n kube-system – curl [http://localhost:9200/\_cat/health](http://localhost:9200/_cat/health) -k -u admin:admin’ kubectl get pods -n kube-system -l k8s-app=elasticsearch-logging |awk ‘{print $1}’|sed ‘1d’|xargs -i sh -c ‘kubectl exec -ti {} -n kube-system – curl [http://localhost:9200/\_cat/indices?v](http://localhost:9200/_cat/indices?v) -k -u admin:admin’ Also works find for kibana log in. [Dockerfile\_kibana\_image.txt](https://forum.search-guard.com/uploads/short-url/zlu8UiwISZOzpdcREhKUp9YMkAK.txt) (235 Bytes) [elasticsearch\_image.tar](https://forum.search-guard.com/uploads/short-url/wSc2nCdkjoysC1zdTdaefXXYFzU.tar) (40 KB) [es-statefulset.yaml](https://forum.search-guard.com/uploads/short-url/51JTo2GRiA8Qf6Txs2FsVsGwY27.yaml) (2.27 KB) ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [November 27, 2018, 7:29pm UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/2 "2018-11-27T19:29:52Z")
Pls delete the .kibana index and report if this fixes the problem. If not pls. upgrade to SG 6.4.3-23.2 and SG Kibana v16 and report if the error is still occuring. On k8s you also can try [GitHub - floragunncom/search-guard-helm: Search Guard Helm Chart for Kubernetes](https://github.com/floragunncom/search-guard-helm) > **···** > > On Tuesday, 27 November 2018 16:50:40 UTC+1, … wrote: > > > > > > When I try to create an “Index Patterns”, always fail as below: > > > > > > > > > ![Untitled.png](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/9f211270f7588200019c6d63b1cf3d4e34949a92.png) > > > > > > > > > elastic search log : > > > [2018-11-27T15:46:42,474][INFO][o.e.c.m.MetaDataMappingService] [voROLHr] [searchguard/-1GwoUFQTeaYFWoxGFWKCQ] update\_mapping [sg] > > > [2018-11-27T15:46:42,631][INFO][c.f.s.c.IndexBaseConfigurationRepository] Search Guard License Info: No license needed because enterprise modules are not enabled > > > [2018-11-27T15:47:06,605][INFO][o.e.c.m.MetaDataCreateIndexService] [voROLHr] [logstash-2018.11.27] creating index, cause [auto(bulk api)], templates , shards [5]/[1], mappings > > > [2018-11-27T15:47:06,792][INFO][o.e.c.m.MetaDataMappingService] [voROLHr] [logstash-2018.11.27/AiH27yT9QE-8QATtHGFZqw] create\_mapping [fluentd] > > > [2018-11-27T15:48:11,049][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] > > > [2018-11-27T15:48:12,802][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] > > > [2018-11-27T15:48:12,917][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] > > > [2018-11-27T15:48:13,190][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] > > > [2018-11-27T15:48:13,312][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] > > > [2018-11-27T15:48:13,748][WARN][o.e.d.a.a.i.t.p.PutIndexTemplateRequest] Deprecated field [template] used, replaced by [index\_patterns] > > > > > > > > > kibana UI show error: > > > - Not Found > > > > > > ```auto > > Error: Not Found > > at Anonymous function ([http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/commons.bundle.js?v=16627:1:312436](http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/commons.bundle.js?v=16627:1:312436) ) > > at processQueue ([http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:132433](http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:132433) ) > > at Anonymous function ([http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:133349](http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:133349) ) > > at Scope.prototype.$digest ([http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:144182](http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:144182) ) > > at Scope.prototype.$apply ([http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:147007](http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:147007) ) > > at done ([http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:99799](http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:99799) ) > > at completeRequest ([http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:104624](http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:104624) ) > > at xhr.onload ([http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:105361](http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/bundles/vendors.bundle.js?v=16627:58:105361)) > > > > ``` > > > > > > > > > > > > elastic search log > > > > > > > > > > > > _ **Note:** _ > > > Works well for below command: > > > kubectl get pods -n > > kube-system -l k8s-app=elasticsearch-logging |awk ‘{print $1}’|sed ‘1d’|xargs > > -i sh -c ‘kubectl exec -ti {} -n > > kube-system – curl [http://localhost:9200/\_cat/health](http://localhost:9200/_cat/health) > > -k -u admin:admin’ > > > kubectl get pods -n > > kube-system -l k8s-app=elasticsearch-logging |awk ‘{print $1}’|sed ‘1d’|xargs > > -i sh -c ‘kubectl exec -ti {} -n > > kube-system – curl [http://localhost:9200/\_cat/indices?v](http://localhost:9200/_cat/indices?v) > > -k -u admin:admin’ > > > > > > Also works find for kibana log in. ---
**Author:** ![johnzhengaz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/johnzhengaz/32/622_2.png) [@johnzhengaz](https://forum.search-guard.com/u/johnzhengaz)\ **Post date:** [November 28, 2018, 7:44am UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/3 "2018-11-28T07:44:44Z")
It works for delete .kibana. (Before delete, I found 2 out of 3 has .kibana index, 1 out of 3 has no .kibana) After delete .kibana, sometimes I can create index pattern successfully. Thanks. ---
**Author:** ![johnzhengaz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/johnzhengaz/32/622_2.png) [@johnzhengaz](https://forum.search-guard.com/u/johnzhengaz)\ **Post date:** [November 28, 2018, 7:45am UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/4 "2018-11-28T07:45:05Z")
I tried a lot of times, the fail rate is very high for 6.2.4. So, I upgraded to SG 6.4.3-23.2 and SG Kibana v16 per your suggestion, the issue still raised! 1 The error alert in kibana: Saved object is missing Could not locate that index-pattern (id: c0838140-f2e0-11e8-a5e0-ef9f9f948c34), [click here to re-create it](http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/app/kibana#/management/kibana/index) 2 There are three es nodes, .kibana only be created on 1 or 2 nodes, not all 3 nodes. ```auto health status index uuid yellow open logstash-2018.11.28 3BnNbv9JTImVV4AnC7hQew green open searchguard L0lqwN1eR1mNHh_fXX8qYQ health status index uuid yellow open logstash-2018.11.28 ig90IAk1QNi-VQOoqyuycQ green open searchguard -frvcPLzQLSjjb6JPOu4fA yellow open .kibana EQqOHoWYSeWNvX1o6xoqQQ health status index uuid green open searchguard Ywpmo63DTfqnCznIG-wyGw yellow open logstash-2018.11.28 M0cgljPrQKW27e1trnma-w ``` ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [November 28, 2018, 8:15am UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/5 "2018-11-28T08:15:40Z")
does it work without search guard installed? > **···** > > On Wednesday, 28 November 2018 08:43:38 UTC+1, … wrote: > > > I tried a lot of times, the fail rate is very high for 6.2.4. > > > So, I upgraded to SG 6.4.3-23.2 and SG Kibana v16 per your suggestion, the issue still raised! > > > > > > 1 The error alert in kibana: > > > Saved object is missing > > > Could not locate that index-pattern (id: c0838140-f2e0-11e8-a5e0-ef9f9f948c34), [click here to re-create it](http://a537d1a7eeeb911e889170eff959d76b-2102519552.us-east-1.elb.amazonaws.com:5601/app/kibana#/management/kibana/index) > > > > > > 2 There are three es nodes, .kibana only be created on 1 or 2 nodes, not all 3 nodes. > > > ```auto > > > > ``` > > > health status index uuid > > > yellow open logstash-2018.11.28 3BnNbv9JTImVV4AnC7hQew > > > green open searchguard L0lqwN1eR1mNHh\_fXX8qYQ > > > health status index uuid > > > yellow open logstash-2018.11.28 ig90IAk1QNi-VQOoqyuycQ > > > green open searchguard -frvcPLzQLSjjb6JPOu4fA > > > yellow open .kibana EQqOHoWYSeWNvX1o6xoqQQ > > > health status index uuid > > > green open searchguard Ywpmo63DTfqnCznIG-wyGw > > > yellow open logstash-2018.11.28 M0cgljPrQKW27e1trnma-w > > > ```auto > > > > ``` ---
**Author:** ![johnzhengaz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/johnzhengaz/32/622_2.png) [@johnzhengaz](https://forum.search-guard.com/u/johnzhengaz)\ **Post date:** [November 28, 2018, 9:00am UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/6 "2018-11-28T09:00:16Z")
Yes, it works without search guard installed. Could you take a look with my docker image for elastic search: [efk\_sg\_in\_k8s/images/elasticsearch\_baseonelk at master · johnzheng1975/efk\_sg\_in\_k8s · GitHub](https://github.com/johnzheng1975/efk_sg_in_k8s/tree/master/images/elasticsearch_baseonelk) my docker image for kibana: [efk\_sg\_in\_k8s/images/kibana at master · johnzheng1975/efk\_sg\_in\_k8s · GitHub](https://github.com/johnzheng1975/efk_sg_in_k8s/tree/master/images/kibana) See whether it is correct? Or you can recommend any successful docker image (es + kibana + sg integration)? Thanks! ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [November 28, 2018, 10:17am UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/7 "2018-11-28T10:17:10Z")
So if the .kibana index is only present on one node this seems more like a Kubernetes or Docker problem to me. The .kibana index is created by Kibana itself and replicated in ES, like any other index. Search Guard does not interfere here in any way. Regarding Docker images, there is this repository you can refer to: > **[GitHub - deviantony/docker-elk at searchguard](https://github.com/deviantony/docker-elk/tree/searchguard)** > > searchguard We have also published experimental Helm charts here: > **[GitHub - floragunncom/search-guard-helm: Search Guard Helm Chart for Kubernetes](https://github.com/floragunncom/search-guard-helm)** > > Search Guard Helm Chart for Kubernetes. Contribute to floragunncom/search-guard-helm development by creating an account on GitHub. The Helm charts are not yet officially supported by us, but you can use them as a reference. This setup is running at a customer site, so it should work basically. > **···** > > On Wednesday, November 28, 2018 at 10:00:16 AM UTC+1, [johnzhengaz@gmail.com](mailto:johnzhengaz@gmail.com) wrote: > > > Yes, it works without search guard installed. > > > Could you take a look with > > > my docker image for elastic search: [https://github.com/johnzheng1975/efk\_sg\_in\_k8s/tree/master/images/elasticsearch\_baseonelk](https://github.com/johnzheng1975/efk_sg_in_k8s/tree/master/images/elasticsearch_baseonelk) > > > my docker image for kibana: [https://github.com/johnzheng1975/efk\_sg\_in\_k8s/tree/master/images/kibana](https://github.com/johnzheng1975/efk_sg_in_k8s/tree/master/images/kibana) > > > See whether it is correct? > > > > > > Or you can recommend any successful docker image (es + kibana + sg integration)? > > > > > > Thanks! ---
**Author:** ![johnzhengaz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/johnzhengaz/32/622_2.png) [@johnzhengaz](https://forum.search-guard.com/u/johnzhengaz)\ **Post date:** [November 28, 2018, 1:07pm UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/8 "2018-11-28T13:07:42Z")
can I use it as free? I means disable enterprise function. thanks. For [GitHub - floragunncom/search-guard-helm: Search Guard Helm Chart for Kubernetes](https://github.com/floragunncom/search-guard-helm), ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [November 28, 2018, 2:06pm UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/9 "2018-11-28T14:06:22Z")
Sure, it’s a public repository, feel free to use anything that helps you. License is Apache2: [https://github.com/floragunncom/search-guard-helm/blob/master/LICENSE](https://github.com/floragunncom/search-guard-helm/blob/master/LICENSE) > **···** > > On Wednesday, November 28, 2018 at 2:07:43 PM UTC+1, [johnzhengaz@gmail.com](mailto:johnzhengaz@gmail.com) wrote: > > > For [https://github.com/](https://github.com/)floragunncom/search-guard-helm, > > can I use it as free? I means disable enterprise function. thanks. ---
**Author:** ![johnzhengaz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/johnzhengaz/32/622_2.png) [@johnzhengaz](https://forum.search-guard.com/u/johnzhengaz)\ **Post date:** [November 29, 2018, 2:16am UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/10 "2018-11-29T02:16:18Z")
That’s great! I am trying search-guard-helm. 🙂 ---
**Author:** ![johnzhengaz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/johnzhengaz/32/622_2.png) [@johnzhengaz](https://forum.search-guard.com/u/johnzhengaz)\ **Post date:** [November 29, 2018, 2:28am UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/11 "2018-11-29T02:28:39Z")
Oh, I know helm is open source. However, for below, I guess it includes enterprise version, right? floragunncom/searchguard-6:6.4.1-23.1 floragunncom/sg-kibana:6.4.1-15 floragunncom/sgadmin:6.4.1-23.1 Can I put disable enterprise function? Is it done like below: In kibana.yml: searchguard.auth.type: “basicauth” In elasticsearch.yml searchguard.enterprise\_modules\_enabled: false Is there any others I should change? Thanks very much for your support! ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [November 29, 2018, 10:35am UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/12 "2018-11-29T10:35:58Z")
Sure, that’s what I wanted to say: The code in the searchguard-helm repository is Apache2: [https://github.com/floragunncom/search-guard-helm/blob/master/LICENSE](https://github.com/floragunncom/search-guard-helm/blob/master/LICENSE) To switch from the Enterprise to the Community Edition you just need to disable the enterprise module in elasticsearch.yml as you pointed out. Nothing more to do. > **···** > > On Thursday, November 29, 2018 at 3:25:49 AM UTC+1, [johnzhengaz@gmail.com](mailto:johnzhengaz@gmail.com) wrote: > > > Oh, I know helm is open source. > > > However, for below, I guess it includes enterprise version, right? > > floragunncom/searchguard-6:6.4.1-23.1 > > > floragunncom/sg-kibana:6.4.1-15 > > > floragunncom/sgadmin:6.4.1-23.1 > > > > > > Can I put disable enterprise function? > > > Is it done like below: > > > In kibana.yml: > > > searchguard.auth.type: > > “basicauth” > > > > > > In elasticsearch.yml > > > searchguard.enterprise\_modules\_enabled: false > > > > > > Is there any others I should change? > > > > > > Thanks very much for your support! > > > ---
**Author:** ![johnzhengaz](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/johnzhengaz/32/622_2.png) [@johnzhengaz](https://forum.search-guard.com/u/johnzhengaz)\ **Post date:** [November 29, 2018, 10:39am UTC](https://forum.search-guard.com/t/kibana-always-create-index-pattern-fail-after-search-guard-integrate-with-k8s/1216/13 "2018-11-29T10:39:29Z")
That’s very cool! Thanks.