Migration from 7.4.1 to 7.6 failed

[barkbay]

Kibana version: Migration from 7.4.1 to 7.6

Elasticsearch version: 7.6

Describe the bug:

A migration failed with the following message:

{ Error: Document contains at least one immense term in field="config.xpackReporting:customPdfLogo.keyword" (whose UTF8 encoding is longer than the max length 32766), all of which were skipped. 
Please correct the analyzer to not produce such terms. 
The prefix of the first immense term is: [100, 97, 116]..., original message: bytes can be at most 32766 in length; got 40102
    at Object.write (/kibana/src/core/server/saved_objects/migrations/core/elastic_index.js:152:21)
    at process._tickCallback (internal/process/next_tick.js:68:7)
  detail:
   { index:
      { _index: '.kibana_6',
        _type: '_doc',
        _id: 'config:7.2.0',
        status: 400,
        error: [Object] } } }

It is quite hard to recover because we have an other error if we try to downgrade to the previous version:

{ Error: Document "Maps-maps_telemetry" has property "task" which belongs to a more recent version of Kibana (7.6.0).

Could an improvement would be to prevent this kind of error by not allowing the user to upload a document with a size > 32766 bytes. ?

[rudolf]

Advanced settings stored in this document use dynamic mappings which for a string, will automatically use the text type with a keyword subtype which includes ignore_above: 256. It looks like we somehow loose the ignore_above: 256 while re-indexing this document as part of a migration.

[elasticmachine]

Pinging @elastic/kibana-platform (Team:Platform)

[rudolf]

I was unable to reproduce this.

I started Kibana 7.4.1 and then did the following:

1. Set a customPdfLogo in advanced settings
2. Create a map (since maps have a migration in 7.5 this ensures that we migrate data)

I then started Kibana 7.6, it detected that documents had to be migrated and then successfully completed the migrations.

For both versions the .kibana_n index had the following config mapping:

"config" : {
          "dynamic" : "true",
          "properties" : {
            "buildNum" : {
              "type" : "keyword"
            },
            "xpackReporting:customPdfLogo" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        }

[rudolf]

The root cause was a dynamic (field mapping) template which was configured to apply to all new indices including the .kibana_n indices.