Kibana Error after updating to 2.3.70

[trb143]

Following a Soup migration from 2.3.160 it is not possible to access kibana.

Running Sudo docker logs so-kibana provides the following error message.

FATAL Error: Unable to complete saved object migrations for the [.kibana_task_manager] index: The .kibana_task_manager alias is pointing to multiple indices: .kibana_task_manager_8.3.2_001,.kibana_task_manager_8.3.3_001.

What is the correct way to fix this?

[dougburks]

Have you tried restarting Kibana?

sudo so-kibana-restart

Also see https://docs.securityonion.net/en/2.3/kibana.html#diagnostic-logging.

[trb143]

Yes twice. Rebooted the server twice as well!

Ran sudo salt-call state.apply kibana.so_savedobjects_defaults -l info queue=True which triggered the error.

Elastalert is working fine as it is detecting ssh logins via logstash.

[dougburks]

Please see https://www.elastic.co/guide/en/kibana/8.4/resolve-migrations-failures.html.