[BUG] Elasticsearch Agent: index named "index" not found

Feedback
,
1

We use a commercial search-engine called “iFinder” (by Intrafind) which extends Elasticsearch.
The name of the main index, containing all of our documents is just called “index”.
There are other indices for internal use with names like index-userinfo, but the main document index is just named “index”
checkmk gets the indices querying elasticsearch with

http://ip:9200"/*-*/_stats/store,docs?ignore_unavailable=true

in file “cmk/special_agents/agent_elasticsearch.py”
Unfortunally *-* finds any index with an “-” in its name, but NOT “index”.
So our main index is not shown in checkmk.

would it be possible to replace *-* by * or “_all” or omit it completely, to find ALL indices?
or is there a good reason to limit the index names to names with a “-” in it?

        section_urls_and_handlers = {
            "cluster_health": ("/_cluster/health", handle_cluster_health),
            "nodes": ("/_nodes/_all/stats", handle_nodes),
            "stats": ("/*-*/_stats/store,docs?ignore_unavailable=true", handle_stats),
        }

Regards
Jürgen Sandner

2

I assume this is done as an index with only a name like your “index” cannot roll over.
You are sure that your “index” is not only an alias to an real index like “index-2024-01-20_0001”? Normally such names are only alias entries pointing to the currently active index.

3

Great, I found a workaround, thank you for the “alias” hint!

“index” ist not an alias, but the real index Name.
Now I created an alias for “index”, which I called “fulltext-index”, obviously with a “-” in this alias-name.

curl -X POST 'http://localhost:9200/_aliases' --header 'Content-Type: application/json' --data '{ "actions": [ { "add": { "index": "index", "alias": "fulltext-index" } } ] }'

Now checkmk finds “index” (not the alias) and includes it in the monitoring.

1 Like