Skip to content

[Winlogbeat] Improve query building and error recovery#42187

Merged
marc-gr merged 5 commits intoelastic:mainfrom
marc-gr:winlogbeat-misc
Jan 3, 2025
Merged

[Winlogbeat] Improve query building and error recovery#42187
marc-gr merged 5 commits intoelastic:mainfrom
marc-gr:winlogbeat-misc

Conversation

@marc-gr
Copy link
Copy Markdown
Contributor

@marc-gr marc-gr commented Dec 31, 2024 •
edited
Loading

Proposed commit message

Improve query building and error recovery:

  • Removes the limitation of 22 clauses by automatically splitting clauses on query building
  • Retries on publisher disabled error in case it is recoverable

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

@marc-gr marc-gr added enhancement Winlogbeat Team:Security-Windows Platform Windows Platform Team in Security Solution labels Dec 31, 2024
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Dec 31, 2024
@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Dec 31, 2024

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @marc-gr? 🙏.
For such, you'll need to label your PR with:

  • The upcoming major version of the Elastic Stack
  • The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit

@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Dec 31, 2024

backport-8.x has been added to help with the transition to the new branch 8.x.
If you don't need it please use backport-skip label and remove the backport-8.x label.

@mergify mergify bot added the backport-8.x Automated backport to the 8.x branch with mergify label Dec 31, 2024
@marc-gr marc-gr marked this pull request as ready for review January 2, 2025 11:50
@marc-gr marc-gr requested a review from a team as a code owner January 2, 2025 11:50
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 2, 2025

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

@marc-gr marc-gr enabled auto-merge (squash) January 3, 2025 15:10
@marc-gr marc-gr merged commit 279d5cc into elastic:main Jan 3, 2025
mergify bot pushed a commit that referenced this pull request Jan 3, 2025
@marc-gr @mergify
[Winlogbeat] Improve query building and error recovery (#42187)
88595cc 
* Retry on publisher disabled error

* Split query to never surpass 22 clauses

* Add changelog entry

(cherry picked from commit 279d5cc)
@mergify mergify bot mentioned this pull request Jan 3, 2025
Merged
6 tasks
marc-gr added a commit that referenced this pull request Jan 7, 2025
@mergify @marc-gr
[Winlogbeat] Improve query building and error recovery (#42187) (#42210)
b8eee43 
* Retry on publisher disabled error

* Split query to never surpass 22 clauses

* Add changelog entry

(cherry picked from commit 279d5cc)

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nfritts nfritts nfritts approved these changes

@matthewscherer matthewscherer matthewscherer approved these changes

Assignees

@marc-gr marc-gr

Labels

backport-8.x Automated backport to the 8.x branch with mergify enhancement Team:Security-Windows Platform Windows Platform Team in Security Solution Winlogbeat

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Winlogbeat] Detect and handle publisher disabled errors [Winlogbeat] Investigate if chaining XPath queries in XML query bypasses 22 clause limit.

4 participants

@marc-gr @elasticmachine @nfritts @matthewscherer