Skip to content

[9.2] [Osquery] Fix pack and saved query APIs returning 500 instead of 404 for "not found" errors (#258883)#259703

Merged
csr merged 2 commits intoelastic:9.2from
csr:backport/9.2/pr-258883
Mar 30, 2026
Merged

[9.2] [Osquery] Fix pack and saved query APIs returning 500 instead of 404 for "not found" errors (#258883)#259703
csr merged 2 commits intoelastic:9.2from
csr:backport/9.2/pr-258883

Conversation

@csr
Copy link
Copy Markdown
Member

@csr csr commented Mar 26, 2026

Backport

This will backport the following commits from main to 9.2:

Questions ?

Please refer to the Backport tool documentation

@csr
[Osquery] Fix pack and saved query APIs returning 500 instead of 404 …
ca697bc 
…for "not found" errors (elastic#258883)

I noticed while working on Scout API tests
(elastic#258534) that the GET endpoints
for packs and saved queries return a `500` Internal Server Error when
the resource doesn't exist, rather than the usual `404`. This PR fixes
it. Worth mentioning that the issue occurs in all surfaces (stateful
deployment, ECH, MKI). Some FTR API integration tests were added to
ensure coverage.

(cherry picked from commit 4301849)
@csr csr requested a review from kibanamachine as a code owner March 26, 2026 09:02
@csr csr added the backport This PR is a backport of another PR label Mar 26, 2026
@csr csr enabled auto-merge (squash) March 26, 2026 09:02
@csr csr mentioned this pull request Mar 26, 2026
Merged
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 26, 2026

💚 Build Succeeded

Metrics [docs]

✅ unchanged

@csr csr requested review from a team, gergoabraham, pzl and szwarckonrad and removed request for a team March 26, 2026 10:40
@szwarckonrad
Copy link
Copy Markdown
Contributor

szwarckonrad commented Mar 26, 2026

@csr

Did we remove saved_queries.ts test in this backport on purpose?

@csr
Copy link
Copy Markdown
Member Author

csr commented Mar 30, 2026 •
edited
Loading

Hi @szwarckonrad - I'm not seeing saved_queries.ts in 9.2: https://github.com/elastic/kibana/blob/9.2/x-pack/platform/test/api_integration/apis/osquery/saved_queries.ts. I can backport the file with just those 404 for non-existent resources tests. Would that work for you?

@csr csr merged commit c25eb05 into elastic:9.2 Mar 30, 2026
14 checks passed
@csr csr mentioned this pull request Mar 31, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@szwarckonrad szwarckonrad szwarckonrad approved these changes

@kibanamachine kibanamachine Awaiting requested review from kibanamachine kibanamachine is a code owner

@pzl pzl Awaiting requested review from pzl pzl was automatically assigned from elastic/security-defend-workflows

@gergoabraham gergoabraham Awaiting requested review from gergoabraham gergoabraham was automatically assigned from elastic/security-defend-workflows

Assignees

No one assigned

Labels

backport This PR is a backport of another PR

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@csr @elasticmachine @szwarckonrad