Array size can't be greater than 2

mrkitt

After ELS update to version 7.4.2, it seems to be a problem to put multiple indexes into a single rule. Before an update, I was able to put 3 indexes into a rule, but now it doesn't allow to put more than 2 which is very inconvenient. As number of new indexes is increasing, it seems to me that I have to duplicate the same rules to run them on different indexes.

SzymonC

Hi,
I'll leave a note in our dev team to check it out. Best way to approach situation like this is also through official support line.

Anyway there's a easy workaround for that, because you can create index pattern from array normally in the system as well. So you can go to the Stack Management -> Index Patterns -> Create Index Pattern and later use this newly created pattern in the Alert:

mrkitt

I followed the steps and created an array. However the problem has not disappeared, it still does not allow to include more than two indexes

SzymonC

Our devs [Thanks, guys!!] released hotfix for this before new ELS version launch (which will have that covered by default). It's available on our repo for download: https://energylogserver.com/repo/hotfix/alerts-2.8.0.zip (username is in your license file .info).

Move this file to ELS UI server, where alert service is running. Place it in /tmp directory.

Execute following command from linux console to apply this fix:
sudo -u kibana /usr/share/kibana/bin/opensearch-dashboards-plugin remove alerts && sudo -u kibana /usr/share/kibana/bin/opensearch-dashboards-plugin install file:///tmp/alerts-2.8.0.zip

After that you restart GUI service systemctl restart kibana and it should be working.

My tests:

mrkitt

thanks, it helped 😀