-
Notifications
You must be signed in to change notification settings - Fork 8.5k
[Ingest Manager] Updating a package immediately after a rollover fails #79370
Copy link
Copy link
Closed
Labels
Team:Defend Workflows“EDR Workflows” sub-team of Security Solution“EDR Workflows” sub-team of Security SolutionTeam:FleetTeam label for Observability Data Collection Fleet teamTeam label for Observability Data Collection Fleet teambugFixes for quality problems that affect the customer experienceFixes for quality problems that affect the customer experienceimpact:highAddressing this issue will have a high level of impact on the quality/strength of our product.Addressing this issue will have a high level of impact on the quality/strength of our product.v7.10.0
Metadata
Metadata
Assignees
Labels
Team:Defend Workflows“EDR Workflows” sub-team of Security Solution“EDR Workflows” sub-team of Security SolutionTeam:FleetTeam label for Observability Data Collection Fleet teamTeam label for Observability Data Collection Fleet teambugFixes for quality problems that affect the customer experienceFixes for quality problems that affect the customer experienceimpact:highAddressing this issue will have a high level of impact on the quality/strength of our product.Addressing this issue will have a high level of impact on the quality/strength of our product.v7.10.0
Type
Fields
Give feedbackNo fields configured for issues without a type.
Updating a package immediately after performing a rollover on a data stream fails.
Steps to reproduce:
POST http://elastic:changeme@localhost:5601/api/ingest_manager/epm/packages/endpoint-0.16.0-dev.3?force=truehttps://github.com/elastic/kibana/blob/9d07a677b89a723db55a3f307bfb09c7ae189de5/x-pack/test/functional/es_archives/endpoint/pipeline/dns/data.json.gz
The above archive will populate data in the
logs-endpoint.events.network-defaultdata stream.POST /logs-endpoint.events.network-default/_rollovervaluefields associated with thedata_streamobject:This is thrown here:
kibana/x-pack/plugins/ingest_manager/server/services/epm/elasticsearch/template/template.ts
Line 407 in c456f64
valuefields populated underdata_streamOr after some time this: