Open stacey-gammon opened 3 years ago
From the ML UI + CCS perspective, much of the standard functionality works over CCS. However if the remote cluster is a prior version which does not contain a certain feature (for example an agg), then we aim to fail early with a useful error message. Functionality that is supported on both versions, continues to work.
Adding context to the list above, for 7.12 -> 6.8:
Error: An error occurred fetching analysis fields data. cannot retrieve data because index [7_12:kibana_sample_data_logs] does not exist
. User can continue to create DFA jobs using index patterns that are not CCS. Ideally we want to fail earlier in the wizard with a better error message. Usability improvement https://github.com/elastic/kibana/issues/95257Error: Failed to validate configuration: Failed to test query: Attempting to serialize [GeoTileGridValuesSourceBuilder] to a node with unsupported version [6.8.14]
. User may continue using transforms providing this agg is not used in the configuration. Versions before 7.11.0 don't support [runtime_mappings] and search was sent to [6.8.14]
. User can continue to create Transforms or Anomaly Detection jobs which do not contain runtime fields.Selected category field is invalid No examples for this field could be found
. As a workaround, user can create the anomaly detection job using API. The UI should not prevent the job from being created. Fix reqd https://github.com/elastic/kibana/issues/94737@stacey-gammon can you please elaborate on what this icon means? 🚧 7.12 Kibana -> 7.11 ES
- does this mean it doesn't work?
If upgrading remote clusters before the cross-cluster search cluster, should the existing CCS Kibana continue to work with the remote clusters throughout the process? (especially with clusters that can take hours to upgrade)
@maggieghamry, I've adjusted the main issue. I meant to indicate that testing is still in progress for that configuration. Please let me know if it is still confusing.
If you upgrade Kibana last, then everything should work. This is specifically testing situations where the Kibana version is ahead of the remote cluster version.
We don't have any automated testing for cross cluster support, it would be nice if we did. I've dealt with cross cluster issues with index pattern creation.
Thank you!
Testing steps:
./bin/elasticsearch
./bin/elasticsearch -E transport.port=9400
127.0.0.1:9400
curl -X PUT http://elastic:changeme@localhost:9201/my-index --data '{"settings":{"number_of_shards":1,"soft_deletes.enabled":true}}' --header "Content-Type: application/json"
my-index
on local clustercurl -X POST http://elastic:changeme@localhost:9201/my-index/_doc --data '{"a": "b"}' --header "Content-Type: application/json"
Success: In all cases (7.12 Kibana -> 6.8 ES, 7.11 Kibana -> 6.8 ES, 7.12 Kibana -> 7.11 ES) I'm able to create a remote cluster and a follower index, and though the resulting index has yellow health it replicates documents.
ML feature testing is done for both paths: 7.12 Kibana -> 7.11 ES: and 7.11 Kibana -> 6.8 ES:
7.12 Kibana -> 7.11 ES:
7.11 Kibana -> 6.8 ES
@stacey-gammon I'll have some things to report on this next week from the Logs perspective.
If discover: discover:searchFieldsFromSource toggle is off (the default), data from the remote cluster will not be returned.
Just for whatever it's worth, the data will all return but the data from the incompatible clusters will be sparse and missing many fields. This will be the case for anyone using the fields
API.
Logs UI testing is now complete:
7.11.2 Kibana -> 6.8.15 ES
7.12.0 Kibana -> 6.8.15 ES
Same as 7.11.2 Kibana -> 6.8.15 ES
7.12.0 Kibana -> 7.11.2 ES
Logs UI works as usual (stream, alerts, and ML) for all data
Note: We expect that 7.12.1 and 7.13 to both work better with cross-cluster 6.8 ES, due to our finding and merging #94972, which will mean that the Log stream will begin to display all logs stored in compatible clusters, but log data from incompatible clusters (e.g. stored in the 6.8 cluster in this example scenario) will still not appear in the Log Stream UI.
Thank you to @weltenwort for completing this testing.
cc: @mukeshelastic @sgrodzicki
Aside from Fleet and Endpoint areas, SIEM has finished testing. There are issues with data not being displayed on the Hosts page and in Timeline, most likely due to the search fields option. In addition, there are issues with alerts generating data. Since 7.12 -> 7.11 has no issues, I also suspect this is due to the search fields option.
Aside from that EQL rules won't work, but this is expected.
More details:
I think we can call this good for Enterprise Search. The solution only accesses its own "system" indices and CCS is not supported for those, so it shouldn't factor in. Additionally, Enterprise Search is recent enough that there isn't support for ES 6.x.
@sophiec20 - regarding your original comment in https://github.com/elastic/kibana/issues/94965#issuecomment-805651213, has anything changed in what we support/don't support specifically around ML?
If customers wish to use CCS in ML, from the Kibana UI, would it be viable or are the missing features sufficient to make it effectively challenging to consider creating ML jobs/datastreams based on local+CCS data?
Essentially I am trying to get an idea of what works and what doesn't based on:
From the ML UI + CCS perspective, much of the standard functionality works over CCS
There are some known limitations when using Kibana and Cross Cluster search to access data on an Elasticsearch cluster that is older than the Kibana version.
Limitations
Details
Search fields options
Using the fields option in search requests in versions >= 7.11 will result in data not being returned from clusters <= 7.10. Areas broken in Kibana include Discover, Canvas (SQL,EQL), Logs and ML, SIEM. There is a workaround currently for Discover, bu turning the
discover:searchFieldsFromSource
toggle on (not the default).Geo tile grid aggregations
These types of aggregations in the maps app and ML will fail if any clusters are <= 6.8 and Kibana is 7.0 and greater.
Progress & Status