Error message for orphaned monitor

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

OpenSearch 2.7.0, but the error was also present in the old version 2.6.0.

Describe the issue:

One of the nodes in the cluster constantly brings the following error in the log, but I can’t find the monitor “Windows Logs” anywhere. How can I fix this error?

osdb-cl01-node03  | [2023-05-03T11:07:12,701][ERROR][o.o.a.u.AlertingException] [osdb-cl01-node03] Alerting error: [.opensearch-sap-windows-detectors-queries-000695] IndexNotFoundException[no such index [.opensearch-sap-windows-detectors-queries-000695]]
osdb-cl01-node03  | [2023-05-03T11:07:12,701][ERROR][o.o.a.DocumentLevelMonitorRunner] [osdb-cl01-node03] Failed to start Document-level-monitor Windows Logs
osdb-cl01-node03  | org.opensearch.alerting.util.AlertingException: Configured indices are not found: [.opensearch-sap-windows-detectors-queries-000695]
osdb-cl01-node03  |     at org.opensearch.alerting.util.AlertingException$Companion.wrap(AlertingException.kt:70) ~[opensearch-alerting-2.7.0.0.jar:2.7.0.0]
osdb-cl01-node03  |     at org.opensearch.alerting.util.DocLevelMonitorQueries.updateQueryIndexMappings(DocLevelMonitorQueries.kt:366) ~[opensearch-alerting-2.7.0.0.jar:2.7.0.0]
osdb-cl01-node03  |     at org.opensearch.alerting.util.DocLevelMonitorQueries.access$updateQueryIndexMappings(DocLevelMonitorQueries.kt:45) ~[opensearch-alerting-2.7.0.0.jar:2.7.0.0]
osdb-cl01-node03  |     at org.opensearch.alerting.util.DocLevelMonitorQueries$updateQueryIndexMappings$1.invokeSuspend(DocLevelMonitorQueries.kt) ~[opensearch-alerting-2.7.0.0.jar:2.7.0.0]
osdb-cl01-node03  |     at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33) [kotlin-stdlib-1.6.10.jar:1.6.10-release-923(1.6.10)]
osdb-cl01-node03  |     at kotlinx.coroutines.DispatchedTask.run(Dispatched.kt:285) [kotlinx-coroutines-core-1.1.1.jar:?]
osdb-cl01-node03  |     at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:594) [kotlinx-coroutines-core-1.1.1.jar:?]
osdb-cl01-node03  |     at kotlinx.coroutines.scheduling.CoroutineScheduler.access$runSafely(CoroutineScheduler.kt:60) [kotlinx-coroutines-core-1.1.1.jar:?]
osdb-cl01-node03  |     at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:742) [kotlinx-coroutines-core-1.1.1.jar:?]
osdb-cl01-node03  | Caused by: java.lang.Exception: org.opensearch.index.IndexNotFoundException: no such index [.opensearch-sap-windows-detectors-queries-000695]
osdb-cl01-node03  |     ... 9 more

Configuration:

Cluster with 3 nodes, initial created with version 2.5.0

Relevant Logs or Screenshots:

n/a

2

This error is from security analytics. You would have created a detector named windows logs. If you delete/disable the detector, the monitor will also be deleted/disabled.

3

I suspected something like this. But how can I fix this error? The error also occurs after a restart