[Fleet] Set default settings in component template instead of the index template#111197
Conversation
…ex template directly
|
Pinging @elastic/fleet (Team:Fleet) |
…3-set-default-settings-in-component-template
|
@elasticmachine merge upstream |
…3-set-default-settings-in-component-template
|
@nchaulet (cc @joshdover) Regarding the Index Lifecycle Policy, I have been looking at how users can customise data retention for integrations as part of https://github.com/elastic/observability-docs/issues/986. In the simplest case, where they wish to customise the retention of data for an integration for all namespaces, they could use the If it isn't much trouble I think I would lean towards moving it to the component template |
|
@hop-dev I think it make sense too. I just moved the ILM settings to the component template. |
Good catch @hop-dev, we need the custom component template to at least be able to set this for all namespaces. Thanks for making the change @nchaulet. |
| ilmPolicy, | ||
| type, | ||
| }: { | ||
| type: string; |
There was a problem hiding this comment.
Can type here only be logs or metrics? Should we express that in the type?
There was a problem hiding this comment.
datastream.type is not typed to only logs and metrics, I think there is some other options too synthetics for example, I would keep this as string for now.
| }, | ||
| }, | ||
| // This is the default from Beats? So far seems to be a good value | ||
| refresh_interval: '5s', |
joshdover
left a comment
There was a problem hiding this comment.
Should we go ahead and incorporate the changes to the defaults that Adrien recommended here: #104620 (comment)
| // What should be our default for the compression? | ||
| codec: 'best_compression', |
There was a problem hiding this comment.
@ruflin Do you know if we really should be using best_compression here? It appears Beats does not use this value and it does slow down field retrieval (though I don't know by how much):
The
defaultvalue compresses stored data with LZ4 compression, but this can be set tobest_compressionwhich uses DEFLATE for a higher compression ratio, at the expense of slower stored fields performance. If you are updating the compression type, the new one will be applied after segments are merged. Segment merging can be forced using force merge.
There was a problem hiding this comment.
@jpountz curious if you have any input on this as well
There was a problem hiding this comment.
In my opinion, it is sensible to use best_speed by default for Enterprise Search data and best_compression for Observability and Security data.
x-pack/plugins/fleet/server/services/epm/elasticsearch/template/default_settings.test.ts
Outdated
Show resolved
Hide resolved
…e/default_settings.test.ts Co-authored-by: Josh Dover <1813008+joshdover@users.noreply.github.com>
|
@joshdover @hop-dev For #104620 I think the changes for the default value could come in a followup PR, it seems related but I like the benefits of having two PR/commits here it make things easier to follow, track future bugs. I will be happy to tackle #104620 later, if you want. |
💚 Build Succeeded
Metrics [docs]
History
To update your PR or re-run it, just comment with: cc @nchaulet |
💚 Backport successful
This backport PR will be merged automatically after passing CI. |
…-link-to-kibana-app * 'master' of github.com:elastic/kibana: (61 commits) [Logs UI] Fix alert previews for thresholds of `0` (elastic#111150) [Archive Migration][Partial] discover apps-discover (elastic#110437) [APM] Set start date of APM ML job to -4 weeks (elastic#111375) [ML] APM Latency Correlations: Code consolidation. (elastic#110790) [Discover] Fix indices permission for multiline test (elastic#111284) [Detection Rules] Add 7.15 rules (elastic#111464) [Security Solution][Endpoint][Host Isolation] Hide isolate host option in alert details rather than disabling (elastic#111064) React version of angular license view (elastic#111317) [APM] Fix link in readme (elastic#111362) [Security Solution] add agent field to generator (elastic#111428) [Dashboard] Retain Tags on Quicksave (elastic#111015) Reorder App Search ingestion methods (elastic#111361) Port performance docs to new docs system. (elastic#111063) [Security Solution][RAC] Fixes updatedAt loading bug (elastic#111010) [sample data] update web log geo.src field to match country code of geo.coordinates (elastic#110885) [Security solution] [Endpoint] Fix bad artifact migration (elastic#111294) Fix copy typo. (elastic#111203) [build] Remove empty optimize directory (elastic#111393) [Maps] fix term join not updating when editing right field (elastic#111030) [Fleet] Set default settings in component template instead of the index template (elastic#111197) ... # Conflicts: # x-pack/plugins/reporting/public/management/__snapshots__/report_listing.test.tsx.snap # x-pack/plugins/reporting/public/management/report_listing.test.tsx
Description
Resolve #105603
Why? To allow to override settings in
template-component@customcomponent template settings need to be defined in a component template.That PR change that and put the default settings in the
template-component@settingscomponent templates.I did some refacto by moving this his own function and added some unit test we were missing here.
Known issue: this is going to be applied to newly installed package only and not to already installed package.
The index lifecycle policy is still defined in the index template? should we move it to the component template too?Update all the index settings are now in the component template @settings.How to test?
In a package:
In a custom component template:
index.number_of_replicasin a custom component template.