When viewing an index pattern in kibana, it now shows no documents in the last 15m. If I run a range query from the devtools page or a curl directly to elasticsearch, it returns the maximum 10k documents. This is seen using any user, including the local admin account. It showed all documents expected after initial installation, but appeared after setting up ldap. I was adding ldap mapped roles at the time, but have since removed all ldap mappings and then tried adding one with all_access role. The behavior has also persisted across kibana and browser/client OS restarts.
roles_mapping.yml
--- manage_snapshots: reserved: false hidden: false backend_roles: - "snapshotrestore" hosts: [] users: [] and_backend_roles: [] logstash: reserved: false hidden: false backend_roles: - "logstash" hosts: [] users: [] and_backend_roles: [] logstash additional: reserved: false hidden: false backend_roles: - "logstash" hosts: [] users: [] and_backend_roles: [] own_index: reserved: false hidden: false backend_roles: [] hosts: [] users: - "*" and_backend_roles: [] description: "Allow full access to an index named like the username" kibana_user: reserved: false hidden: false backend_roles: - "kibanauser" - "ldabadmins" hosts: [] users: [] and_backend_roles: [] description: "Maps kibanauser to kibana_user" _meta: type: "rolesmapping" config_version: 2 all_access: reserved: false hidden: false backend_roles: - "admin" - "ldapadmins" hosts: [] users: [] and_backend_roles: [] description: "Maps admin to all_access" readall: reserved: false hidden: false backend_roles: - "readall" hosts: [] users: [] and_backend_roles: [] kibana_server: reserved: true hidden: false backend_roles: [] hosts: [] users: - "kibanaserver" and_backend_roles: []