Skip to content

Conversation

@justinkambic
Copy link
Contributor

Backports the following commits to 7.x:

@justinkambic justinkambic added the backport This PR is a backport of another PR label Sep 1, 2020
@kibanamachine
Copy link
Contributor

💛 Build succeeded, but was flaky


Test Failures

X-Pack Detection Engine API Integration Tests.x-pack/test/detection_engine_api_integration/basic/tests/add_prepackaged_rules·ts.detection engine api security and spaces enabled add_prepackaged_rules validation errors should give an error that the index must exist first if it does not exist before adding prepackaged rules

Link to Jenkins

Standard Out

Failed Tests Reporter:
  - Test has not failed recently on tracked branches

[00:00:00]       │
[00:00:00]         └-: detection engine api security and spaces enabled
[00:00:00]           └-> "before all" hook
[00:00:00]           └-: add_prepackaged_rules
[00:00:00]             └-> "before all" hook
[00:00:00]             └-: validation errors
[00:00:00]               └-> "before all" hook
[00:00:00]               └-> should give an error that the index must exist first if it does not exist before adding prepackaged rules
[00:00:00]                 └-> "before each" hook: global before each
[00:00:00]                 │ info [o.e.c.m.MetadataMappingService] [kibana-ci-immutable-centos-tests-xxl-1598990047784349705] [.kibana_1/m6LbLzsyT2qIX-cLhLxRSw] update_mapping [_doc]
[00:00:00]                 │ info [o.e.c.r.a.AllocationService] [kibana-ci-immutable-centos-tests-xxl-1598990047784349705] Cluster health status changed from [YELLOW] to [GREEN] (reason: [shards started [[.kibana-event-log-7.10.0-000001][0]]]).
[00:00:00]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-centos-tests-xxl-1598990047784349705] moving index [.kibana-event-log-7.10.0-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [kibana-event-log-policy]
[00:00:00]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-centos-tests-xxl-1598990047784349705] moving index [.kibana-event-log-7.10.0-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [kibana-event-log-policy]
[00:00:00]                 │ proc [kibana]   log   [21:02:28.379] [warning][plugins][reporting] Enabling the Chromium sandbox provides an additional layer of protection.
[00:00:00]                 │ info [o.e.x.i.IndexLifecycleTransition] [kibana-ci-immutable-centos-tests-xxl-1598990047784349705] moving index [.kibana-event-log-7.10.0-000001] from [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-follow-shard-tasks"}] in policy [kibana-event-log-policy]
[00:00:01]                 └- ✖ fail: detection engine api security and spaces enabled add_prepackaged_rules validation errors should give an error that the index must exist first if it does not exist before adding prepackaged rules
[00:00:01]                 │       Error: expected { message: 'KQLSyntaxError: Expected "(", NOT, value, whitespace but ")" found.\nalert.attributes.alertTypeId: siem.signals AND alert.attributes.tags: "__internal_immutable:true" and ((alert.attributes.alertTypeId:.index-threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:siem.signals and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:siem.notifications and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:metrics.alert.threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:metrics.alert.inventory.threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:logs.alert.document.count and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_cluster_health and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_license_expiration and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_cpu_usage and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_nodes_changed and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_logstash_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_kibana_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_elasticsearch_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.transaction_duration and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.transaction_duration_anomaly and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.error_rate and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.monitorStatus and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.tls and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.durationAnomaly and alert.attributes.consumer:()))\n-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------^: Bad Request',
[00:00:01]                 │   status_code: 400 } to sort of equal { message: 'Pre-packaged rules cannot be installed until the signals index is created: .siem-signals-default',
[00:00:01]                 │   status_code: 400 }
[00:00:01]                 │       + expected - actual
[00:00:01]                 │ 
[00:00:01]                 │        {
[00:00:01]                 │       -  "message": "KQLSyntaxError: Expected \"(\", NOT, value, whitespace but \")\" found.\nalert.attributes.alertTypeId: siem.signals AND alert.attributes.tags: \"__internal_immutable:true\" and ((alert.attributes.alertTypeId:.index-threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:siem.signals and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:siem.notifications and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:metrics.alert.threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:metrics.alert.inventory.threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:logs.alert.document.count and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_cluster_health and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_license_expiration and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_cpu_usage and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_nodes_changed and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_logstash_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_kibana_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_elasticsearch_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.transaction_duration and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.transaction_duration_anomaly and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.error_rate and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.monitorStatus and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.tls and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.durationAnomaly and alert.attributes.consumer:()))\n-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------^: Bad Request"
[00:00:01]                 │       +  "message": "Pre-packaged rules cannot be installed until the signals index is created: .siem-signals-default"
[00:00:01]                 │          "status_code": 400
[00:00:01]                 │        }
[00:00:01]                 │       
[00:00:01]                 │       at Assertion.assert (/dev/shm/workspace/parallel/9/kibana/packages/kbn-expect/expect.js:100:11)
[00:00:01]                 │       at Assertion.eql (/dev/shm/workspace/parallel/9/kibana/packages/kbn-expect/expect.js:244:8)
[00:00:01]                 │       at Context.it (test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts:33:25)
[00:00:01]                 │ 
[00:00:01]                 │ 

Stack Trace

{ Error: expected { message: 'KQLSyntaxError: Expected "(", NOT, value, whitespace but ")" found.\nalert.attributes.alertTypeId: siem.signals AND alert.attributes.tags: "__internal_immutable:true" and ((alert.attributes.alertTypeId:.index-threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:siem.signals and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:siem.notifications and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:metrics.alert.threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:metrics.alert.inventory.threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:logs.alert.document.count and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_cluster_health and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_license_expiration and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_cpu_usage and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_nodes_changed and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_logstash_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_kibana_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_elasticsearch_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.transaction_duration and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.transaction_duration_anomaly and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.error_rate and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.monitorStatus and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.tls and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.durationAnomaly and alert.attributes.consumer:()))\n-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------^: Bad Request',
  status_code: 400 } to sort of equal { message: 'Pre-packaged rules cannot be installed until the signals index is created: .siem-signals-default',
  status_code: 400 }
    at Assertion.assert (/dev/shm/workspace/parallel/9/kibana/packages/kbn-expect/expect.js:100:11)
    at Assertion.eql (/dev/shm/workspace/parallel/9/kibana/packages/kbn-expect/expect.js:244:8)
    at Context.it (test/detection_engine_api_integration/basic/tests/add_prepackaged_rules.ts:33:25)
  actual:
   '{\n  "message": "KQLSyntaxError: Expected \\"(\\", NOT, value, whitespace but \\")\\" found.\\nalert.attributes.alertTypeId: siem.signals AND alert.attributes.tags: \\"__internal_immutable:true\\" and ((alert.attributes.alertTypeId:.index-threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:siem.signals and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:siem.notifications and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:metrics.alert.threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:metrics.alert.inventory.threshold and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:logs.alert.document.count and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_cluster_health and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_license_expiration and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_cpu_usage and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_nodes_changed and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_logstash_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_kibana_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:monitoring_alert_elasticsearch_version_mismatch and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.transaction_duration and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.transaction_duration_anomaly and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:apm.error_rate and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.monitorStatus and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.tls and alert.attributes.consumer:()) or (alert.attributes.alertTypeId:xpack.uptime.alerts.durationAnomaly and alert.attributes.consumer:()))\\n-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------^: Bad Request"\n  "status_code": 400\n}',
  expected:
   '{\n  "message": "Pre-packaged rules cannot be installed until the signals index is created: .siem-signals-default"\n  "status_code": 400\n}',
  showDiff: true }

Build metrics

✅ unchanged

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@justinkambic justinkambic self-assigned this Sep 2, 2020
@justinkambic justinkambic added Team:Uptime - DEPRECATED Synthetics & RUM sub-team of Application Observability v7.10.0 labels Sep 2, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/uptime (Team:uptime)

@justinkambic justinkambic merged commit 02770a0 into elastic:7.x Sep 2, 2020
@justinkambic justinkambic mentioned this pull request Sep 2, 2020
7 tasks
@justinkambic justinkambic deleted the backport/7.x/pr-76386 branch September 2, 2020 14:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR Team:Uptime - DEPRECATED Synthetics & RUM sub-team of Application Observability v7.10.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants