Skip to content

Commit 1bcf978

Browse files
committed
Hide 409 errors during signal creation
These are expected and potentially confusing to the user. Instead, we only show unexpected errors.
1 parent 40dd650 commit 1bcf978

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/single_bulk_create.ts

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* you may not use this file except in compliance with the Elastic License.
55
*/
66

7-
import { countBy } from 'lodash';
7+
import { countBy, isEmpty } from 'lodash';
88
import { performance } from 'perf_hooks';
99
import { AlertServices } from '../../../../../alerting/server/types';
1010
import { SignalSearchResponse, BulkResponse } from './types';
@@ -82,9 +82,9 @@ export const singleBulkCreate = async ({
8282
if (response.errors) {
8383
const itemsWithErrors = response.items.filter(item => item.create.error);
8484
const errorCountsByStatus = countBy(itemsWithErrors, item => item.create.status);
85-
const hasNonDuplicateError = Object.keys(errorCountsByStatus).some(status => status !== '409');
85+
delete errorCountsByStatus['409']; // Duplicate signals are expected
8686

87-
if (hasNonDuplicateError) {
87+
if (!isEmpty(errorCountsByStatus)) {
8888
logger.error(
8989
`[-] bulkResponse had errors with response statuses:counts of...\n${JSON.stringify(
9090
errorCountsByStatus,

0 commit comments

Comments
 (0)