[Nginx]: Ignore events older than field not available for Nginx logs dataset.

[amolnater-qasource]

Kibana version: 8.4.0 BC3 Kibana cloud environment

Host OS: All

Build details:
VERSION: 8.4.0 BC3
BUILD: 55281
COMMIT: e42c547d7ab545472fd978383c2c43fa203a5b06

Preconditions:

1. 8.4.0 BC3 Kibana cloud environment should be available.
2. Policy should be created using Nginx integration.

Integration Version:
Nginx v1.4.1
(Same version is available on latest 8.4 Snapshot)

Steps to reproduce:

1. Navigate to Fleet>Agents Policies tab.
2. Click Edit Nginx integration and observe Nginx logs dataset>Advanced.
3. Observe Ignore events older than field not available for Nginx datasets.

Related Feature:
#3691

Screen Recording:

Agent.policy.2.-.Agent.policies.-.Fleet.-.Elastic.-.Google.Chrome.2022-08-12.15-17-49.mp4

Expected Result:
Ignore events older than field should be available for Nginx logs dataset.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[amolnater-qasource]

@manishgupta-qasource Please review.

[amolnater-qasource]

FYI @fearful-symmetry

[manishgupta-qasource]

Secondary review for this ticket is Done

[fearful-symmetry]

Not sure why I'm being pinged here?

[amolnater-qasource]

Hi @fearful-symmetry

As we have seen that you been working on the similar PR at #3691

So while going through that ticket, we did some testing on 8.4 BC3 and found the issue reported above.

Considering the above fact we have mentioned you in this ticket.

Please let us know in case we need to assign different person or team.

Thanks

[fearful-symmetry]

So, I only made one change to nginx because I had time, but generally it's not my area. However, it looks like the the change with ignore_older is still in snapshot, so I have a promotion PR here: elastic/package-storage#5344

[amolnater-qasource]

Hi @fearful-symmetry

Thank you for the update.
We will revalidate this issue once the attached PR is merged.

Thanks!

[amolnater-qasource]

Hi @jlind23
We have revalidated testing Ignore events older than feature on latest 8.4.1 BC2 and observed Nginx version is still v1.4.1.

• v1.5.0 Nginx version is still not available.

Build details:
BUILD: 55434
COMMIT: 415cecc1c67ed775c4d9f6592fe5acc35dc9dce5

Screenshot:

Thanks

[jlind23]

@amolnater-qasource because @fearful-symmetry promoted it from snapshot to staging but i am sure it needs to be promoted to production in order to be available on BC.

[amolnater-qasource]

Hi Team
We have revalidated this on latest 8.4.1 released kibana cloud build and observed latest version Nginx integration v1.5.0 still not available.

Build details:
BUILD: 55434
COMMIT: 415cecc1c67ed775c4d9f6592fe5acc35dc9dce5

Screenshot:

Thanks

[jlind23]

@amolnater-qasource this was promoted from snapshot to staging only: elastic/package-storage#5344

@fearful-symmetry can you promote it to production please?

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!