Description
openedon May 25, 2021
Kibana version: 7.13.0
Elasticsearch version: 7.13.0
Describe the bug:
In 7.13.0, we changed the type of the alert saved object params property, from type: object; enabled: false to type: flattened in PR #92036.
kibana/x-pack/plugins/alerting/server/saved_objects/mappings.json
Lines 49 to 51 in a0ddca8
Unfortunately, this will cause a problem for any field in the params which is greater than 32766 byte long; we just saw such an alert fail in a migration in an internal repo.
FATAL Error: Unable to complete saved object migrations for the [.kibana] index.
Error: pickupUpdatedMappings task failed with the following failures:
[
{
"index": ".kibana_7.13.0_001",
"type": "_doc",
"id": "alert:1b5a5b52-5fdb-4a17-9ecb-909083978c60",
"cause": {
"type": "illegal_argument_exception",
"reason": "Document contains at least one immense term in field=\"alert.params\" (whose UTF8 encoding is longer
than the max length 32766), all of which were skipped. Please correct the analyzer to not produce such terms. The
prefix of the first immense term is: '[bytes elited]...', original message: bytes can be at most 32766 in length;
got 92326",
"caused_by": {
"type": "max_bytes_length_exceeded_exception",
"reason": "max_bytes_length_exceeded_exception: bytes can be at most 32766 in length; got 92326"
}
},
"status": 400
}
]
I haven't repro'd it yet, but I would expect that you could cause this to fail with a normal alert creation with a param over the length limit. If that doesn't fail, or fails differently, I think we'd want to try to repro the migration failure directly, by creating an alert with a huge param in 7.12, then migrating to 7.13.
