How do I resolve the "Unable to find saved objects" error after upgrading Amazon Elasticsearch Service?

Last updated: 2020-04-10

I recently upgraded my Amazon Elasticsearch Service (Amazon ES) cluster to version 7.1. However, I receive an "Unable to find saved objects" error in Kibana. How do I resolve this issue?

Short Description

Users of Amazon ES clusters can sometimes encounter a 400 Bad Request error after upgrading to Amazon ES version 7.1. The upgrade can cause issues where users are unable to find saved objects in Kibana. Additionally, the .kibana index can't be restored directly when using Kibana versions 7.x. Instead, the .kibana index must be used as an alias. For example, if you upgrade to version 7.1, Kibana will migrate into the .kibana_1 index and then up set .kibana as an index alias.

Resolution

To find and restore saved objects in Kibana, perform the following steps:

1.    Create a .kibana_1 index, using the following mappings:

PUT /.kibana_1
{                                                            
    "aliases": {},
    "mappings": {
      "properties": {
        "config": {
          "properties": {
            "buildNum": {
              "type": "long"
            }
          }
        },
        "index-pattern": {
          "properties": {
            "fields": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "timeFieldName": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            },
            "title": {
              "type": "text",
              "fields": {
                "keyword": {
                  "type": "keyword",
                  "ignore_above": 256
                }
              }
            }
          }
        },
        "type": {
          "type": "keyword",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "updated_at": {
          "type": "date"
        }
      }
    },
    "settings": {
      "index": {
        "number_of_shards": "1",
        "number_of_replicas": "1"
      }
    }
}

2.    Then, create a .kibana_backup index:

PUT .kibana_backup

3.    Use reindex API to copy data from the .kibana index to the .kibana_backup index, using the following queries:

POST _reindex
{
  "source": {
    "index": ".kibana"
  },
  "dest": {
    "index": ".kibana_backup"
  }
}

These queries copy and save your data in the .kibana_backup index.

4.    Delete the .kibana index:

DELETE .kibana

5.    Create a .kibana alias and point to the .kibana _1 index:

POST /_aliases
{
    "actions" : [
        { "add" : { "index" : ".kibana_1", "alias" : ".kibana" } }
    ]
}

6.    Use the reindex API to copy data from the .kibana_backup index to the newly created .kibana_1 index:  

POST _reindex
{
  "source": {
    "index": ".kibana_backup"
  },
  "dest": {
    "index": ".kibana_1"
  }
}

The data from .kibana_backup is now restored and saved in the .kibana_1 index.

7.    Search for the saved index pattern or create a new one from the Kibana Management tab. If you are able to perform these tasks, it verifies that the issue has been resolved.

8.    Remove the .kibana_backup index to clear everything:

DELETE .kibana_backup

Did this article help you?

Anything we could improve?


Need more help?