Skip to content

[Detection Engine] FTR test to replicate undefined elasticsearch state#230148

Closed
rylnd wants to merge 13 commits intoelastic:mainfrom
rylnd:rylnd/instrument-ftr-rebased
Closed

[Detection Engine] FTR test to replicate undefined elasticsearch state#230148
rylnd wants to merge 13 commits intoelastic:mainfrom
rylnd:rylnd/instrument-ftr-rebased

Conversation

@rylnd
Copy link
Copy Markdown
Contributor

@rylnd rylnd commented Aug 1, 2025

Summary

🚧
This is temporary branch. It is a rebased copy of #228850, excluding Robert's fixes. I'm creating a draft PR here in order to trigger a flaky run, to try and accomplish what failed (by succeeding the build) in this comment.

dgieselaar and others added 11 commits July 31, 2025 19:20
This integration test is executed 100 times, with the single-document
archive being loaded and unloaded before/after each test. If this test
fails, it will eliminate the detection engine as a culprit.
This should allow us to more clearly trace what's happening via APM
data.
As there might be useful info in here, and using the logging service is
apparently equivalent to `> /dev/null`
Again, this should offer more visibility into what the tests are doing.
By specifying an ID in our archive doc, we should no longer get the
duplication, but I expect instead to see the index request fail in the
state produced by these tests.
@elasticmachine
Copy link
Copy Markdown
Contributor

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

  • Click to trigger kibana-pull-request for this PR!
  • Click to trigger kibana-deploy-project-from-pr for this PR!
  • Click to trigger kibana-deploy-cloud-from-pr for this PR!

@kibanamachine
Copy link
Copy Markdown
Contributor

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#8960

[❌] x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/general_logic/basic_license_essentials_tier/configs/ess.config.ts: 0/100 tests passed.

see run history

@kibanamachine
Copy link
Copy Markdown
Contributor

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#8961

[❌] x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/general_logic/basic_license_essentials_tier/configs/ess.config.ts: 0/1 tests passed.

see run history

@kibanamachine
Copy link
Copy Markdown
Contributor

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#8971

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/general_logic/basic_license_essentials_tier/configs/ess.config.ts: 10/10 tests passed.

see run history

@rylnd
Copy link
Copy Markdown
Contributor Author

rylnd commented Aug 1, 2025

The previous 10x run with an _id specified produced no failures. That's a good start, but I'm trying another 100x run to be sure: https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/8972

@kibanamachine
Copy link
Copy Markdown
Contributor

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#8972

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/general_logic/basic_license_essentials_tier/configs/ess.config.ts: 100/100 tests passed.

see run history

Just making sure the tests now fail, again, as a sanity check.
@rylnd
Copy link
Copy Markdown
Contributor Author

rylnd commented Aug 1, 2025

The 100x run passed, as well, so it seems as though the issue is closely tied to the _id generation, somehow; I've not been able to reproduce the version_exception that I thought would manifest in this case.

@rylnd
Copy link
Copy Markdown
Contributor Author

rylnd commented Aug 1, 2025

Welp, those 30x without id passed, which means the previous runs using _id may have been false positives. I will re-evaluate next week.

@kibanamachine
Copy link
Copy Markdown
Contributor

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#8976

[✅] x-pack/test/security_solution_api_integration/test_suites/detections_response/detection_engine/rule_execution_logic/general_logic/basic_license_essentials_tier/configs/ess.config.ts: 30/30 tests passed.

see run history

@rylnd
Copy link
Copy Markdown
Contributor Author

rylnd commented Aug 12, 2025

Closing as this work has now (mostly) been completed with #229457 for es_archiver and #231392 for our internal dataGeneratorFactory.

I suspect there may still be a case where we would now fail due to a conflict on _id, but I have been unable to reproduce that behavior here. If it manifests on CI, we can investigate further.

@rylnd rylnd closed this Aug 12, 2025
@rylnd rylnd deleted the rylnd/instrument-ftr-rebased branch August 12, 2025 20:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants