Skip to content

[RAC][Rule Registry] Implement RuleDataService.getReader() that skips index bootstrapping #111173

@banderror

Description

@banderror

Parent ticket: #101016

Summary

Background: #108115 (comment)

The observability plugin initializes an instance of RuleDataClient in order to only be able to read from all observability indices (observability.logs, observability.apm, etc). It does this by calling:

    const ruleDataClient = ruleDataService.initializeIndex({
      feature: 'observability',
      registrationContext: 'observability',
      dataset: Dataset.alerts,
      componentTemplateRefs: [],
      componentTemplates: [],
      indexTemplate: {
        version: 0,
      },
    });

This doesn't lead to any index bootstrapping only because no component templates and other resources are specified. However, this is not super safe and it misuses this method.

We need to expose a separate method for getting a reader that would not even try to check if any bootstrapping is necessary:

    const ruleDataReader = ruleDataService.getReader({
      feature: 'observability',
      registrationContext: 'observability',
      dataset: Dataset.alerts,
    });

Metadata

Metadata

Assignees

No one assigned

    Labels

    Team: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Detections and RespSecurity Detection Response TeamTheme: raclabel obsolete

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions