Skip to content

Multi-target syntax bug with datastream backing indices and excluded targets #86019

@joegallo

Description

@joegallo

Elasticsearch Version

8.3.0-SNAPSHOT / "build_hash" : "dea288efdccb144b9002949368cc8c3fee004b96"

Installed Plugins

No response

Java Version

bundled

OS Version

Darwin galactic.localdomain 21.4.0 Darwin Kernel Version 21.4.0: Fri Mar 18 00:45:05 PDT 2022; root:xnu-8020.101.4~15/RELEASE_X86_64 x86_64

Problem Description

Some datastream and index name expressions don't resolve as expected when security is enabled.

Steps to Reproduce

# create a datastream

PUT _index_template/test-logs-data-stream
{
  "index_patterns": [ "test-logs-*" ],
  "data_stream": { },
  "template": {
    "settings" : {
      "index": {
        "refresh_interval": "1s"
      },
      "number_of_shards": 1,
      "number_of_replicas": 0
    }
  }
}

PUT _data_stream/test-logs-1

# observe that there is one index, and that it's the one for the datastream

GET _cat/indices?s=index
# as expected, these each return the field caps for the _id field for the one index

GET test-logs*/_field_caps?fields=_id

GET .ds-test-logs*/_field_caps?fields=_id
# as expected, these expressions return 0 results

# expect 0 results, get 0 results, good
GET test-logs*,-test-logs*/_field_caps?fields=_id

# expect 0 results, get 0 results, also good
GET .ds-test-logs*,-.ds-test-logs*/_field_caps?fields=_id
# but here's the bug, these two don't return 0 results

# expect 0 results, get 1 results, bad
GET .ds-test-logs*,-test-logs*/_field_caps?fields=_id

# expect 0 results, get 1 results, also bad
GET test-logs*,-.ds-test-logs*/_field_caps?fields=_id

Note: this doesn't reproduce if you're running without security enabled (i.e. ./gradlew run -Dtests.es.xpack.security.enabled=false -Dtests.es.xpack.license.self_generated.type=trial).

Logs (if relevant)

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions