What does "Matches restricted index pattern defined in the cluster setting mean?

Question

I am trying to apply a policy to an index in OpenSearch

   POST _opendistro/_ism/add/.kibana_1
{
  "policy_id": "test"
}

.kibana_1 is an index that automatically got created even though I am not using Kibana. I wanted to write an auto delete policy using ISM to delete if this index gets over 20GB. But I get this error when i try to attach the policy to this index

{ "updated_indices" : 0, "failures" : true, "failed_indices" : [ { "index_name" : ".kibana_1", "index_uuid" : "someuuid", "reason" : "Matches restricted index pattern defined in the cluster setting" } ] }

Answer 1

Encountered the same issue on opensearch 1.3.x.

The issue is because of a setting for index state management that restricts the ISM policies from being applied to certain index patterns:

plugins.index_state_management.restricted_index_pattern

The default value includes .opendistro_security, .kibana*, and ,opendistro-ism-config.

Annoyingly, the setting doesn't seem to appear in the official docs but you can find it by checking all the cluster settings GET _cluster/settings?include_defaults=true&flat_settings.

The fix is to put the setting on the opensearch.yml config or hit PUT _cluster/settings and adjust the setting value.

{
  "persistent": {
    "plugins.index_state_management.restricted_index_pattern" : ".opendistro_security|.opendistro-ism-config"
  }
}