[BUG]: Cannot create index_pattern via API

[sevenval-admins]

Hi,
I am trying to create index_pattern via API, but I do for sure something wrong.
If I give
curl -s -k -u admin:pw -XPOST "https://my-opensearch.local:9200/api/opensearch-dashboards/index_patterns/" -H "kbn-xsrf: true" -H "Content-Type: application/json; charset=utf-8" -H "securitytenant: test-tenant2" -d '{"attributes": {"title": "test-opensearch-*","timeFieldName": "@timestamp"} }'| jq -r
then I get a success message but I cant find the index_pattern nowhere:

{
  "_index": "api",
  "_type": "opensearch-dashboards",
  "_id": "index_patterns",
  "_version": 10,
  "result": "created",
  "_shards": {
    "total": 2,
    "successful": 1,
    "failed": 0
  },
  "_seq_no": 17,
  "_primary_term": 1
}  

On the other hand if I give
curl -s -k -u admin:pw -XPOST "https://my-opensearch.local:9200/api/saved_objects/index_patterns/" -H "kbn-xsrf: true" -H "Content-Type: application/json; charset=utf-8" -H "securitytenant: test-tenant2" -d '{"attributes": {"title": "test-opensearch-*","timeFieldName": "@timestamp"} }'| jq -r
then I get the following message:

{
  "error": {
    "root_cause": [
      {
        "type": "illegal_argument_exception",
        "reason": "Rejecting mapping update to [api] as the final mapping would have more than 1 type: [opensearch-dashboards, saved_objects]"
      }
    ],
    "type": "illegal_argument_exception",
    "reason": "Rejecting mapping update to [api] as the final mapping would have more than 1 type: [opensearch-dashboards, saved_objects]"
  },
  "status": 400
}

I tried with the method you described hier too, but no success.
Could you please provide a complete example on how to create index_patterns with API?
Thanks a lot
Davide

[kavilla]

Hello @sevenval-admins, thanks for this!

I think these are flaws in the documentation that will need to be improved upon.

Just to clarify, do you have OpenSearch Dashboards running on top of OpenSearch? By default the port 9200 is reserved for the OpenSearch engine and OpenSearch Dashboards by default will be running on port 5601. You can definitely end up with some configuration where OpenSearch Dashboards is on on 9200 so if you are doing that then ignore what I'm going to say here, but you should be hitting whatever port you are running OpenSearch Dashboards on. So assuming it should be 5601, can you try the following:

curl -s -k -u admin:pw -XPOST "https://my-opensearch.local:5601/api/saved_objects/index-pattern" -H "osd-xsrf: true" -H "Content-Type: application/json; charset=utf-8" -H "securitytennant: test-tenant2" -d '{"attributes": {"title": "test-opensearch-*","timeFieldName": "@timestamp"} }'

Just some things to highlight:

• kbn-xsrf --> osd-xsrf, can you point out the document that references that so we can fix that.
  • Although, this seems like a backwards compatibility thing as well, we can fix this to allow both headers if there are enough workflows that have this hardcoded.
• api/saved_objects/index_patterns --> api/saved_objects/index-pattern, can you point out this doc as well so we can fix that as well.

I think this link: https:/opensearch-project/OpenSearch-Dashboards/blob/main/DEVELOPER_GUIDE.md#api-endpoints leaves too much for interpretation. We should create an issue as well to make this more descriptive.

Thanks again for pointing this out! Let me know if you get the results you are seeking and if you can answer some of the follow-ups, that would be super appreciative. I can do to the making of issues/fixing.

[sevenval-admins]

Hi @kavilla thanks a lot for your reply. My OpenSearch Dashboard runs on port 5601. However, the query you suggested does not work.
I was able to build one that works perfectly:
curl -s -k -u admin:pw -XPOST "https://my-opensearch.local:9200/.kibana/_doc/index-pattern:test-opensearch-*" -H "kbn-xsrf: true" -H "Content-Type: application/json;" -H "securitytenant: test-tenant2" -d '{"type" : "index-pattern","index-pattern" : {"title": "test-opensearch-*","timeFieldName": "@timestamp"}}' | jq -r
The received message confirm that the index_pattern was created:

{
  "_index": ".kibana_339124877_testtenant2_1",
  "_type": "_doc",
  "_id": "index-pattern:test-opensearch-**",
  "_version": 1,
  "result": "created",
  "_shards": {
    "total": 1,
    "successful": 1,
    "failed": 0
  },
  "_seq_no": 46,
  "_primary_term": 1
}

and I can see the created index_pattern in the UI under my custom test-tentant2 Tenant. This old issue was really helpful to me.
I hope this will be of help to you so that you can supplement the relevant documentation.

[kavilla]

However, the query you suggested does not work.

What was the error message you are seeing.

The way you provided is another way to create an index pattern but that is hitting OpenSearch instead of going through to OpenSearch Dashboards. As the issue you link, it could be related to the tenants if so then it would be a problem with the security plugin.

Let me know! Appreciate the help!

[sevenval-admins]

Hi, no error was displayed, it just didn´t create an index pattern.

[joshuarrrr]

@sevenval-admins It sounds like you were able to resolve the issue. @kavilla did you want to create a new documentation issue? Other than that, I think we can close this one.

[pitch-d]

can you try the following:

curl -s -k -u admin:pw -XPOST "https://my-opensearch.local:5601/api/saved_objects/index-pattern" -H "osd-xsrf: true" -H "Content-Type: application/json; charset=utf-8" -H "securitytennant: test-tenant2" -d '{"attributes": {"title": "test-opensearch-*","timeFieldName": "@timestamp"} }'

please notice that securitytenant is misspelled above
took me some hours to find that 😆