# Weird error when trying to update index pattern

**URL:** <https://forum.opensearch.org/t/weird-error-when-trying-to-update-index-pattern/17682>\
**Category:** Security\
**Created:** [February 1, 2024, 1:19pm UTC](https://forum.opensearch.org/t/weird-error-when-trying-to-update-index-pattern/17682 "2024-02-01T13:19:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rlevitsky](https://avatars.discourse-cdn.com/v4/letter/r/49beb7/32.png) [@rlevitsky](https://forum.opensearch.org/u/rlevitsky)\
**Post date:** [February 1, 2024, 1:19pm UTC](https://forum.opensearch.org/t/weird-error-when-trying-to-update-index-pattern/17682/1 "2024-02-01T13:19:30Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

OpenSearch 2.9.0 on Linux

**Describe the issue** :

Few days ago I noticed that users (including admins) are unable to update index pattern.  
All went as usual, sometimes number of fields changes, however, when you reload index pattern, number of fields remains the same.

Exploring logs, I noticed what seems quite weird to me:

> {“type”:“error”,“@timestamp”:“2024-02-01T13:09:41Z”,“tags”:,“pid”:1,“level”:“error”,“error”:{“message”:“Internal Server Error”,“name”:“Error”,“stack”:“Error: Internal Server Error\n at HapiResponseAdapter.toError (/usr/share/opensearch-dashboards/src/core/server/http/router/response\_adapter.js:143:19)\n at HapiResponseAdapter.toHapiResponse (/usr/share/opensearch-dashboards/src/core/server/http/router/response\_adapter.js:97:19)\n at HapiResponseAdapter.handle (/usr/share/opensearch-dashboards/src/core/server/http/router/response\_adapter.js:92:17)\n at Router.handle (/usr/share/opensearch-dashboards/src/core/server/http/router/router.js:164:34)\n at runMicrotasks ()\n at processTicksAndRejections (node:internal/process/task\_queues:96:5)\n at handler (/usr/share/opensearch-dashboards/src/core/server/http/router/router.js:124:50)\n at exports.Manager.execute (/usr/share/opensearch-dashboards/node\_modules/@hapi/hapi/lib/toolkit.js:60:28)\n at Object.internals.handler (/usr/share/opensearch-dashboards/node\_modules/@hapi/hapi/lib/handler.js:46:20)\n at exports.execute (/usr/share/opensearch-dashboards/node\_modules/@hapi/hapi/lib/handler.js:31:20)\n at Request.\_lifecycle (/usr/share/opensearch-dashboards/node\_modules/@hapi/hapi/lib/request.js:371:32)\n at Request.\_execute (/usr/share/opensearch-dashboards/node\_modules/@hapi/hapi/lib/request.js:281:9)”},“url”:“[http://logs-staging.nl2.exadel.com/api/saved\_objects/index-pattern/1da8d2d0-c103-11ee-90f5-db300e02a36f",“message”:"Internal](http://logs-staging.nl2.exadel.com/api/saved_objects/index-pattern/1da8d2d0-c103-11ee-90f5-db300e02a36f%22,%22message%22:%22Internal) Server Error”}

**Configuration** :

Doesn’t seem to had changed last few months

**Relevant Logs or Screenshots** :

> {“type”:“response”,“@timestamp”:“2024-02-01T13:09:40Z”,“tags”:,“pid”:1,“method”:“get”,“statusCode”:200,“req”:{“url”:“/api/index\_patterns/\_fields\_for\_wildcard?pattern=minio-%2A&meta\_fields=\_source&meta\_fields=\_id&meta\_fields=\_type&meta\_fields=\_index&meta\_fields=\_score”,“method”:“get”,“headers”:{“connection”:“upgrade”,“host”:“[logs-staging.nl2.exadel.com](http://logs-staging.nl2.exadel.com)”,“sec-ch-ua”:“"Not A(Brand";v="99", "Google Chrome";v="121", "Chromium";v="121"”,“content-type”:“application/json”,“osd-xsrf”:“osd-fetch”,“sec-ch-ua-mobile”:“?0”,“user-agent”:“Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36”,“osd-version”:“2.9.0”,“sec-ch-ua-platform”:“"Linux"”,“accept”:“_/_”,“sec-fetch-site”:“same-origin”,“sec-fetch-mode”:“cors”,“sec-fetch-dest”:“empty”,“referer”:“[https://logs-staging.nl2.exadel.com/app/management/opensearch-dashboards/indexPatterns/patterns/1da8d2d0-c103-11ee-90f5-db300e02a36f",“accept-encoding”:"gzip](https://logs-staging.nl2.exadel.com/app/management/opensearch-dashboards/indexPatterns/patterns/1da8d2d0-c103-11ee-90f5-db300e02a36f%22,%22accept-encoding%22:%22gzip), deflate, br”,“accept-language”:“en-US,en;q=0.9”,“securitytenant”:“EISD\_DEV”},“remoteAddress”:“127.0.0.1”,“userAgent”:“Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36”,“referer”:“[https://logs-staging.nl2.exadel.com/app/management/opensearch-dashboards/indexPatterns/patterns/1da8d2d0-c103-11ee-90f5-db300e02a36f"},“res”:{“statusCode”:200,“responseTime”:16,“contentLength”:9},“message”:"GET](https://logs-staging.nl2.exadel.com/app/management/opensearch-dashboards/indexPatterns/patterns/1da8d2d0-c103-11ee-90f5-db300e02a36f%22%7D,%22res%22:%7B%22statusCode%22:200,%22responseTime%22:16,%22contentLength%22:9%7D,%22message%22:%22GET) /api/index\_patterns/\_fields\_for\_wildcard?pattern=minio-%2A&meta\_fields=\_source&meta\_fields=\_id&meta\_fields=\_type&meta\_fields=\_index&meta\_fields=\_score 200 16ms - 9.0B”}  
> {“type”:“log”,“@timestamp”:“2024-02-01T13:09:41Z”,“tags”:[“error”,“opensearch”,“data”],“pid”:1,“message”:“[security\_exception]: Update is not supported when FLS or DLS or Fieldmasking is activated”}  
> {“type”:“error”,“@timestamp”:“2024-02-01T13:09:41Z”,“tags”:,“pid”:1,“level”:“error”,“error”:{“message”:“Internal Server Error”,“name”:“Error”,“stack”:“Error: Internal Server Error\n at HapiResponseAdapter.toError (/usr/share/opensearch-dashboards/src/core/server/http/router/response\_adapter.js:143:19)\n at HapiResponseAdapter.toHapiResponse (/usr/share/opensearch-dashboards/src/core/server/http/router/response\_adapter.js:97:19)\n at HapiResponseAdapter.handle (/usr/share/opensearch-dashboards/src/core/server/http/router/response\_adapter.js:92:17)\n at Router.handle (/usr/share/opensearch-dashboards/src/core/server/http/router/router.js:164:34)\n at runMicrotasks ()\n at processTicksAndRejections (node:internal/process/task\_queues:96:5)\n at handler (/usr/share/opensearch-dashboards/src/core/server/http/router/router.js:124:50)\n at exports.Manager.execute (/usr/share/opensearch-dashboards/node\_modules/@hapi/hapi/lib/toolkit.js:60:28)\n at Object.internals.handler (/usr/share/opensearch-dashboards/node\_modules/@hapi/hapi/lib/handler.js:46:20)\n at exports.execute (/usr/share/opensearch-dashboards/node\_modules/@hapi/hapi/lib/handler.js:31:20)\n at Request.\_lifecycle (/usr/share/opensearch-dashboards/node\_modules/@hapi/hapi/lib/request.js:371:32)\n at Request.\_execute (/usr/share/opensearch-dashboards/node\_modules/@hapi/hapi/lib/request.js:281:9)”},“url”:“[http://logs-staging.nl2.exadel.com/api/saved\_objects/index-pattern/1da8d2d0-c103-11ee-90f5-db300e02a36f",“message”:"Internal](http://logs-staging.nl2.exadel.com/api/saved_objects/index-pattern/1da8d2d0-c103-11ee-90f5-db300e02a36f%22,%22message%22:%22Internal) Server Error”}  
> {“type”:“response”,“@timestamp”:“2024-02-01T13:09:41Z”,“tags”:,“pid”:1,“method”:“put”,“statusCode”:500,“req”:{“url”:“/api/saved\_objects/index-pattern/1da8d2d0-c103-11ee-90f5-db300e02a36f”,“method”:“put”,“headers”:{“connection”:“upgrade”,“host”:“[logs-staging.nl2.exadel.com](http://logs-staging.nl2.exadel.com)”,“content-length”:“47226”,“sec-ch-ua”:“"Not A(Brand";v="99", "Google Chrome";v="121", "Chromium";v="121"”,“content-type”:“application/json”,“osd-xsrf”:“osd-fetch”,“sec-ch-ua-mobile”:“?0”,“user-agent”:“Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36”,“osd-version”:“2.9.0”,“sec-ch-ua-platform”:“"Linux"”,“accept”:“_/_”,“origin”:“[https://logs-staging.nl2.exadel.com](https://logs-staging.nl2.exadel.com)”,“sec-fetch-site”:“same-origin”,“sec-fetch-mode”:“cors”,“sec-fetch-dest”:“empty”,“referer”:“[https://logs-staging.nl2.exadel.com/app/management/opensearch-dashboards/indexPatterns/patterns/1da8d2d0-c103-11ee-90f5-db300e02a36f",“accept-encoding”:"gzip](https://logs-staging.nl2.exadel.com/app/management/opensearch-dashboards/indexPatterns/patterns/1da8d2d0-c103-11ee-90f5-db300e02a36f%22,%22accept-encoding%22:%22gzip), deflate, br”,“accept-language”:“en-US,en;q=0.9”,“securitytenant”:“EISD\_DEV”},“remoteAddress”:“127.0.0.1”,“userAgent”:“Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36”,“referer”:“[https://logs-staging.nl2.exadel.com/app/management/opensearch-dashboards/indexPatterns/patterns/1da8d2d0-c103-11ee-90f5-db300e02a36f"},“res”:{“statusCode”:500,“responseTime”:14,“contentLength”:9},“message”:"PUT](https://logs-staging.nl2.exadel.com/app/management/opensearch-dashboards/indexPatterns/patterns/1da8d2d0-c103-11ee-90f5-db300e02a36f%22%7D,%22res%22:%7B%22statusCode%22:500,%22responseTime%22:14,%22contentLength%22:9%7D,%22message%22:%22PUT) /api/saved\_objects/index-pattern/1da8d2d0-c103-11ee-90f5-db300e02a36f 500 14ms - 9.0B”}

Full log:

---

<div class="post-metadata">

**Author:** ![rlevitsky](https://avatars.discourse-cdn.com/v4/letter/r/49beb7/32.png) [@rlevitsky](https://forum.opensearch.org/u/rlevitsky)\
**Post date:** [February 1, 2024, 1:30pm UTC](https://forum.opensearch.org/t/weird-error-when-trying-to-update-index-pattern/17682/2 "2024-02-01T13:30:00Z")

</div>

Just to make sure, this is how my request looks like at security-auditlog:

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/d/d14f2626e90073cf609ddc83a6705994627e7c15.png)

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [February 1, 2024, 2:54pm UTC](https://forum.opensearch.org/t/weird-error-when-trying-to-update-index-pattern/17682/3 "2024-02-01T14:54:38Z")

</div>

> [@rlevitsky](#):
>
> [“error”,“opensearch”,“data”],“pid”:1,“message”:“[security\_exception]: Update is not supported when FLS or DLS or Fieldmasking is activated”}

Have you made any changes to the user’s roles in terms of FLS, DLS or field masking (Anonymization )?

Could you share roles\_mapping.yml and the name of the test user?

---

<div class="post-metadata">

**Author:** ![rlevitsky](https://avatars.discourse-cdn.com/v4/letter/r/49beb7/32.png) [@rlevitsky](https://forum.opensearch.org/u/rlevitsky)\
**Post date:** [February 2, 2024, 9:13am UTC](https://forum.opensearch.org/t/weird-error-when-trying-to-update-index-pattern/17682/4 "2024-02-02T09:13:31Z")

</div>

Thank you @pablo for your reply!

I just realized that adding fake DLS to ‘sa’ (our sysadmins’ group) [How is DLS applied when user has multiple roles - #6 by rlevitsky](https://forum.opensearch.org/t/how-is-dls-applied-when-user-has-multiple-roles/2946/6)  
have broken this.

So either some our sysadmins (those who are in any devs group) are unable to see all their indices or nobody (including cluster\_admins) is able to update any index pattern (you can delete and recreate, though, but that’s not convenient).

Is there any chance we can have both?