{"action":"opened","issue":{"url":"https://api.github.com/repos/wazuh/wazuh-kibana-app/issues/338","repository_url":"https://api.github.com/repos/wazuh/wazuh-kibana-app","labels_url":"https://api.github.com/repos/wazuh/wazuh-kibana-app/issues/338/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh-kibana-app/issues/338/comments","events_url":"https://api.github.com/repos/wazuh/wazuh-kibana-app/issues/338/events","html_url":"https://github.com/wazuh/wazuh-kibana-app/issues/338","id":308190667,"number":338,"title":"Wazuh initialization failing when Elasticsearch contains more than 10 index patterns","user":{"login":"JPLachance","id":3448802,"avatar_url":"https://avatars2.githubusercontent.com/u/3448802?v=4","gravatar_id":"","url":"https://api.github.com/users/JPLachance","html_url":"https://github.com/JPLachance","followers_url":"https://api.github.com/users/JPLachance/followers","following_url":"https://api.github.com/users/JPLachance/following{/other_user}","gists_url":"https://api.github.com/users/JPLachance/gists{/gist_id}","starred_url":"https://api.github.com/users/JPLachance/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JPLachance/subscriptions","organizations_url":"https://api.github.com/users/JPLachance/orgs","repos_url":"https://api.github.com/users/JPLachance/repos","events_url":"https://api.github.com/users/JPLachance/events{/privacy}","received_events_url":"https://api.github.com/users/JPLachance/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-23T21:58:43Z","updated_at":"2018-03-23T21:58:43Z","closed_at":null,"author_association":"NONE","body":"Greetings again! 😄 \r\n\r\nAfter a long investigation, I finally figured out that [the Elasticsearch query to list index patterns](https://github.com/wazuh/wazuh-kibana-app/blob/8c1b72406c8cc721fe2c3d1e1aa34baf53c4d077/server/api/wazuh-elastic.js#L127) is only querying the first 10 patterns.\r\n\r\nListing only the first 10 results is the default behavior in Elasticsearch:\r\n![screen shot 2018-03-23 at 17 32 51](https://user-images.githubusercontent.com/3448802/37854423-40ccac6c-2ec1-11e8-83c1-b76dd495efee.png)\r\n\r\nSo, in the UI, the [checkPatterns](https://github.com/wazuh/wazuh-kibana-app/blob/6b89fa1b84b76c678bcbf932f0493d4d3bb16e2b/public/controllers/health-check.js#L21) function is always failing even if the pattern exists because it's the last one in the list of 51 patterns.\r\n\r\nIt means that on any Elasticsearch installation with more than 10 index patterns, the Wazuh application initialization may fail randomly or all the time.\r\n\r\nSolution: add the `size` parameter in the Query!\r\n![screen shot 2018-03-23 at 17 52 41](https://user-images.githubusercontent.com/3448802/37854860-14f4456c-2ec3-11e8-920b-e93d150f6ced.png)\r\n\r\nIn the [Kibana source code](https://github.com/elastic/kibana/blob/f93b76285b0fec16306a1c28b3fe91d8d80d8b14/src/core_plugins/kibana/public/management/sections/objects/_objects.js#L13), we can see they solved that issue by querying the first 10000 results. I think it could be a safe bet!\r\n\r\nThanks for your time!\r\n"}}
{"actor":{"display_login":"JPLachance"}}