Skip to content

[Osquery] Fix pack and saved query APIs returning 500 instead of 404 for "not found" errors#258883

Merged
csr merged 6 commits intoelastic:mainfrom
csr:fix-osquery-apis-returning-500-instead-of-404
Mar 23, 2026
Merged

[Osquery] Fix pack and saved query APIs returning 500 instead of 404 for "not found" errors#258883
csr merged 6 commits intoelastic:mainfrom
csr:fix-osquery-apis-returning-500-instead-of-404

Conversation

@csr
Copy link
Copy Markdown
Member

@csr csr commented Mar 20, 2026 •
edited by kibanamachine
Loading

I noticed while working on Scout API tests (#258534) that the GET endpoints for packs and saved queries return a 500 Internal Server Error when the resource doesn't exist, rather than the usual 404. This PR fixes it. Worth mentioning that the issue occurs in all surfaces (stateful deployment, ECH, MKI). Some FTR API integration tests were added to ensure coverage.

@csr csr self-assigned this Mar 20, 2026
@csr csr added release_note:skip Skip the PR/issue when compiling release notes backport:all-open Backport to all branches that could still receive a release labels Mar 20, 2026
csr
csr commented Mar 20, 2026
View reviewed changes
x-pack/platform/test/api_integration/apis/osquery/packs.ts
).to.be(singleLineQuery);
});

describe('404 for non-existent resources', () => {
Copy link
Copy Markdown
Member Author

@csr csr Mar 20, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Making sure these changes have coverage (they previously didn't). While it's true that some (if not all) of these tests will be replaced by Scout, let's ensure these changes are correct right away. These new FTR tests are passing locally.

@csr csr marked this pull request as ready for review March 20, 2026 16:18
@csr csr requested a review from a team as a code owner March 20, 2026 16:18
@csr csr requested review from gergoabraham and pzl March 20, 2026 16:18
tomsonpl
tomsonpl requested changes Mar 23, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@tomsonpl tomsonpl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for fixing the issue :) Really appreciate the help! :)

I left a comment, I believe it's crucial to be addressed before merging this PR.

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 23, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] Jest Tests #2 / buildEsqlFetchSubscribe changing a ES|QL query with no transformational commands should not change state when loading and finished if index pattern and columns are the same
  • [job] [logs] FTR Configs #96 / lens app - group 5 lens formula should duplicate a moving average formula and be a valid table with conditional coloring
  • [job] [logs] FTR Configs #166 / machine learning - data visualizer - group1 field statistics in Discover when enabled with geo point field displays the 'Field statistics' table content correctly

Metrics [docs]

✅ unchanged

History

cc @csr

@csr csr requested a review from tomsonpl March 23, 2026 14:16
tomsonpl
tomsonpl approved these changes Mar 23, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@tomsonpl tomsonpl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for addressing the issue, LGTM 👍

@csr csr enabled auto-merge (squash) March 23, 2026 14:55
@csr csr merged commit 4301849 into elastic:main Mar 23, 2026
19 checks passed
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Mar 23, 2026

Starting backport for target branches: 8.19, 9.2, 9.3

https://github.com/elastic/kibana/actions/runs/23447332485

@csr csr deleted the fix-osquery-apis-returning-500-instead-of-404 branch March 23, 2026 16:10
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Mar 23, 2026

💔 All backports failed

Status Branch Result
❌ 8.19 Backport failed because of merge conflicts
❌ 9.2 Backport failed because of merge conflicts
❌ 9.3 Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 258883

Questions ?

Please refer to the Backport tool documentation

@csr csr mentioned this pull request Mar 23, 2026
Merged
kubasobon pushed a commit that referenced this pull request Mar 24, 2026
@csr @kubasobon
[Osquery] Fix pack and saved query APIs returning 500 instead of 404 …
6bb10d7 
…for "not found" errors (#258883)

I noticed while working on Scout API tests
(#258534) that the GET endpoints
for packs and saved queries return a `500` Internal Server Error when
the resource doesn't exist, rather than the usual `404`. This PR fixes
it. Worth mentioning that the issue occurs in all surfaces (stateful
deployment, ECH, MKI). Some FTR API integration tests were added to
ensure coverage.
@kibanamachine kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Mar 24, 2026
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Mar 24, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 258883 locally
cc: @csr

2 similar comments
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Mar 25, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 258883 locally
cc: @csr

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Mar 25, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 258883 locally
cc: @csr

csr added a commit to csr/kibana that referenced this pull request Mar 26, 2026
@csr
[Osquery] Fix pack and saved query APIs returning 500 instead of 404 …
2b20a72 
…for "not found" errors (elastic#258883)

I noticed while working on Scout API tests
(elastic#258534) that the GET endpoints
for packs and saved queries return a `500` Internal Server Error when
the resource doesn't exist, rather than the usual `404`. This PR fixes
it. Worth mentioning that the issue occurs in all surfaces (stateful
deployment, ECH, MKI). Some FTR API integration tests were added to
ensure coverage.

(cherry picked from commit 4301849)

# Conflicts:
#	x-pack/platform/plugins/shared/osquery/server/routes/pack/delete_pack_route.ts
#	x-pack/platform/plugins/shared/osquery/server/routes/pack/update_pack_route.ts
#	x-pack/platform/plugins/shared/osquery/server/routes/saved_query/update_saved_query_route.ts
#	x-pack/platform/test/api_integration/apis/osquery/saved_queries.ts
@csr csr mentioned this pull request Mar 26, 2026
Merged
jeramysoucy pushed a commit to jeramysoucy/kibana that referenced this pull request Mar 26, 2026
@csr @jeramysoucy
[Osquery] Fix pack and saved query APIs returning 500 instead of 404 …
72c64ce 
…for "not found" errors (elastic#258883)

I noticed while working on Scout API tests
(elastic#258534) that the GET endpoints
for packs and saved queries return a `500` Internal Server Error when
the resource doesn't exist, rather than the usual `404`. This PR fixes
it. Worth mentioning that the issue occurs in all surfaces (stateful
deployment, ECH, MKI). Some FTR API integration tests were added to
ensure coverage.
csr added a commit to csr/kibana that referenced this pull request Mar 26, 2026
@csr
[Osquery] Fix pack and saved query APIs returning 500 instead of 404 …
ca697bc 
…for "not found" errors (elastic#258883)

I noticed while working on Scout API tests
(elastic#258534) that the GET endpoints
for packs and saved queries return a `500` Internal Server Error when
the resource doesn't exist, rather than the usual `404`. This PR fixes
it. Worth mentioning that the issue occurs in all surfaces (stateful
deployment, ECH, MKI). Some FTR API integration tests were added to
ensure coverage.

(cherry picked from commit 4301849)
@csr csr mentioned this pull request Mar 26, 2026
Merged
csr added a commit to csr/kibana that referenced this pull request Mar 26, 2026
@csr
[Osquery] Fix pack and saved query APIs returning 500 instead of 404 …
9d538ff 
…for "not found" errors (elastic#258883)

I noticed while working on Scout API tests
(elastic#258534) that the GET endpoints
for packs and saved queries return a `500` Internal Server Error when
the resource doesn't exist, rather than the usual `404`. This PR fixes
it. Worth mentioning that the issue occurs in all surfaces (stateful
deployment, ECH, MKI). Some FTR API integration tests were added to
ensure coverage.

(cherry picked from commit 4301849)
@csr csr mentioned this pull request Mar 26, 2026
Merged
@csr
Copy link
Copy Markdown
Member Author

csr commented Mar 26, 2026

💚 All backports created successfully

Status Branch Result
✅ 9.3
✅ 9.2
✅ 8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Mar 26, 2026

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.
cc: @csr

1 similar comment
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Mar 27, 2026

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.
cc: @csr

csr added a commit that referenced this pull request Mar 30, 2026
@csr
[9.2] [Osquery] Fix pack and saved query APIs returning 500 instead o…
c25eb05 
…f 404 for "not found" errors (#258883) (#259703)

# Backport

This will backport the following commits from `main` to `9.2`:
- [[Osquery] Fix pack and saved query APIs returning 500 instead of 404
for "not found" errors
(#258883)](#258883)

<!--- Backport version: 11.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Cesare de
Cal","email":"cesare.decal@elastic.co"},"sourceCommit":{"committedDate":"2026-03-23T16:09:12Z","message":"[Osquery]
Fix pack and saved query APIs returning 500 instead of 404 for \"not
found\" errors (#258883)\n\nI noticed while working on Scout API
tests\n(#258534) that the GET
endpoints\nfor packs and saved queries return a `500` Internal Server
Error when\nthe resource doesn't exist, rather than the usual `404`.
This PR fixes\nit. Worth mentioning that the issue occurs in all
surfaces (stateful\ndeployment, ECH, MKI). Some FTR API integration
tests were added to\nensure
coverage.","sha":"4301849b361347096590df70c0229d63f63dc932","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport
missing","backport:all-open","v9.4.0"],"title":"[Osquery] Fix pack and
saved query APIs returning 500 instead of 404 for \"not found\"
errors","number":258883,"url":"https://github.com/elastic/kibana/pull/258883","mergeCommit":{"message":"[Osquery]
Fix pack and saved query APIs returning 500 instead of 404 for \"not
found\" errors (#258883)\n\nI noticed while working on Scout API
tests\n(#258534) that the GET
endpoints\nfor packs and saved queries return a `500` Internal Server
Error when\nthe resource doesn't exist, rather than the usual `404`.
This PR fixes\nit. Worth mentioning that the issue occurs in all
surfaces (stateful\ndeployment, ECH, MKI). Some FTR API integration
tests were added to\nensure
coverage.","sha":"4301849b361347096590df70c0229d63f63dc932"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/258883","number":258883,"mergeCommit":{"message":"[Osquery]
Fix pack and saved query APIs returning 500 instead of 404 for \"not
found\" errors (#258883)\n\nI noticed while working on Scout API
tests\n(#258534) that the GET
endpoints\nfor packs and saved queries return a `500` Internal Server
Error when\nthe resource doesn't exist, rather than the usual `404`.
This PR fixes\nit. Worth mentioning that the issue occurs in all
surfaces (stateful\ndeployment, ECH, MKI). Some FTR API integration
tests were added to\nensure
coverage.","sha":"4301849b361347096590df70c0229d63f63dc932"}}]}]
BACKPORT-->
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Mar 31, 2026

Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync.
cc: @csr

csr added a commit that referenced this pull request Apr 1, 2026
@csr
[8.19] [Osquery] Fix pack and saved query APIs returning 500 instead …
c0ddf2b 
…of 404 for "not found" errors (#258883) (#259704)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Osquery] Fix pack and saved query APIs returning 500 instead of 404
for "not found" errors
(#258883)](#258883)

<!--- Backport version: 11.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Cesare de
Cal","email":"cesare.decal@elastic.co"},"sourceCommit":{"committedDate":"2026-03-23T16:09:12Z","message":"[Osquery]
Fix pack and saved query APIs returning 500 instead of 404 for \"not
found\" errors (#258883)\n\nI noticed while working on Scout API
tests\n(#258534) that the GET
endpoints\nfor packs and saved queries return a `500` Internal Server
Error when\nthe resource doesn't exist, rather than the usual `404`.
This PR fixes\nit. Worth mentioning that the issue occurs in all
surfaces (stateful\ndeployment, ECH, MKI). Some FTR API integration
tests were added to\nensure
coverage.","sha":"4301849b361347096590df70c0229d63f63dc932","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport
missing","backport:all-open","v9.4.0"],"title":"[Osquery] Fix pack and
saved query APIs returning 500 instead of 404 for \"not found\"
errors","number":258883,"url":"https://github.com/elastic/kibana/pull/258883","mergeCommit":{"message":"[Osquery]
Fix pack and saved query APIs returning 500 instead of 404 for \"not
found\" errors (#258883)\n\nI noticed while working on Scout API
tests\n(#258534) that the GET
endpoints\nfor packs and saved queries return a `500` Internal Server
Error when\nthe resource doesn't exist, rather than the usual `404`.
This PR fixes\nit. Worth mentioning that the issue occurs in all
surfaces (stateful\ndeployment, ECH, MKI). Some FTR API integration
tests were added to\nensure
coverage.","sha":"4301849b361347096590df70c0229d63f63dc932"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/258883","number":258883,"mergeCommit":{"message":"[Osquery]
Fix pack and saved query APIs returning 500 instead of 404 for \"not
found\" errors (#258883)\n\nI noticed while working on Scout API
tests\n(#258534) that the GET
endpoints\nfor packs and saved queries return a `500` Internal Server
Error when\nthe resource doesn't exist, rather than the usual `404`.
This PR fixes\nit. Worth mentioning that the issue occurs in all
surfaces (stateful\ndeployment, ECH, MKI). Some FTR API integration
tests were added to\nensure
coverage.","sha":"4301849b361347096590df70c0229d63f63dc932"}}]}]
BACKPORT-->
csr added a commit that referenced this pull request Apr 1, 2026
@csr
[9.3] [Osquery] Fix pack and saved query APIs returning 500 instead o…
56eb2dd 
…f 404 for "not found" errors (#258883) (#259702)

# Backport

This will backport the following commits from `main` to `9.3`:
- [[Osquery] Fix pack and saved query APIs returning 500 instead of 404
for "not found" errors
(#258883)](#258883)

<!--- Backport version: 11.0.1 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Cesare de
Cal","email":"cesare.decal@elastic.co"},"sourceCommit":{"committedDate":"2026-03-23T16:09:12Z","message":"[Osquery]
Fix pack and saved query APIs returning 500 instead of 404 for \"not
found\" errors (#258883)\n\nI noticed while working on Scout API
tests\n(#258534) that the GET
endpoints\nfor packs and saved queries return a `500` Internal Server
Error when\nthe resource doesn't exist, rather than the usual `404`.
This PR fixes\nit. Worth mentioning that the issue occurs in all
surfaces (stateful\ndeployment, ECH, MKI). Some FTR API integration
tests were added to\nensure
coverage.","sha":"4301849b361347096590df70c0229d63f63dc932","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport
missing","backport:all-open","v9.4.0"],"title":"[Osquery] Fix pack and
saved query APIs returning 500 instead of 404 for \"not found\"
errors","number":258883,"url":"https://github.com/elastic/kibana/pull/258883","mergeCommit":{"message":"[Osquery]
Fix pack and saved query APIs returning 500 instead of 404 for \"not
found\" errors (#258883)\n\nI noticed while working on Scout API
tests\n(#258534) that the GET
endpoints\nfor packs and saved queries return a `500` Internal Server
Error when\nthe resource doesn't exist, rather than the usual `404`.
This PR fixes\nit. Worth mentioning that the issue occurs in all
surfaces (stateful\ndeployment, ECH, MKI). Some FTR API integration
tests were added to\nensure
coverage.","sha":"4301849b361347096590df70c0229d63f63dc932"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/258883","number":258883,"mergeCommit":{"message":"[Osquery]
Fix pack and saved query APIs returning 500 instead of 404 for \"not
found\" errors (#258883)\n\nI noticed while working on Scout API
tests\n(#258534) that the GET
endpoints\nfor packs and saved queries return a `500` Internal Server
Error when\nthe resource doesn't exist, rather than the usual `404`.
This PR fixes\nit. Worth mentioning that the issue occurs in all
surfaces (stateful\ndeployment, ECH, MKI). Some FTR API integration
tests were added to\nensure
coverage.","sha":"4301849b361347096590df70c0229d63f63dc932"}}]}]
BACKPORT-->
@kibanamachine kibanamachine added v9.3.3 and removed backport missing Added to PRs automatically when the are determined to be missing a backport. labels Apr 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tomsonpl tomsonpl tomsonpl approved these changes

@pzl pzl Awaiting requested review from pzl pzl is a code owner automatically assigned from elastic/security-defend-workflows

@gergoabraham gergoabraham Awaiting requested review from gergoabraham gergoabraham is a code owner automatically assigned from elastic/security-defend-workflows

Assignees

@csr csr

Labels

backport:all-open Backport to all branches that could still receive a release release_note:skip Skip the PR/issue when compiling release notes v8.19.14 v9.2.8 v9.3.3 v9.4.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@csr @elasticmachine @kibanamachine @tomsonpl