[BUG] Unable to create index pattern using all_access role

[oleksandrfatikov]

Describe the bug
I’m trying to create an index pattern on newly set up opensearch in k8s. Once I create it and get back to ‘Discover’ tab, there are no index patterns and opensearch suggest creating new one.

To Reproduce
Steps to reproduce the behavior:

1. Install opensearch and dashboards in k8s using helm charts;
2. Install fluent-bit to deliver logs to opensearch;
3. Login under ‘admin’ user with ‘all_access’ role;
4. Go to ‘Discover’ on WI and create a new pattern;
5. Pattern is created (screenshot attached);
6. Go back to ‘Discover’ and there are no index patterns;

Expected behavior
The index pattern is created and I can browse logs from 'Discover' tab.

Screenshots

Host/Environment (please complete the following information):
Environment: k8s v1.27.2
Opensearch/dashboards version: 2.11.0
Opensearch chart version: 2.16.1
Dashboards chart version: 2.14.0

Additional context

• I created clusters previously and deleted them along with the disk volumes, so it should be a clean install, but may be this is somehow connected, because I can’t see other reason for such behavior.
• Also if I go to ‘Saved Objects’ on 'Index patterns' page, I get the following error in the browser console:
  "message": "all shards failed: search_phase_execution_exception: [illegal_argument_exception] Reason: Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [type] in order to load field data by uninverting the inverted index. Note that this can use significant memory."

[dblock]

Looks like a bug. Thanks for reporting it. Catch All Triage - 1 2 3 4 5