Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Reporting] change how the .kibana-reporting datastream is created #211658

Open
pmuellr opened this issue Feb 18, 2025 · 1 comment
Open

[Reporting] change how the .kibana-reporting datastream is created #211658

pmuellr opened this issue Feb 18, 2025 · 1 comment
Labels
Feature:Reporting:Framework Reporting issues pertaining to the overall framework Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@pmuellr
Copy link
Member

pmuellr commented Feb 18, 2025

We currently have some SDHs that are being caused by the .kibana-reporting index not being created by ES, because of the ES config setting stack.templates.enabled: false.

KB article: https://support.elastic.dev/knowledge/view/42d36e7e

Seems like we should change this to create the datastream ourself. We have lots of experience now, between the event log and alerts indices, for creation/updating. This would mean reporting wouldn't be sensitive to the ES config setting.

If we start seeing more of these issues, and need something delivered sooner, we could probably at least make the issue more obvious:

  • check before we generate the report, and don't bother generating the report if it's not going to work
  • add something to the existing diagnostic run on the reporting page
  • add something to the Kibana diagnostic bundle
  • ???

The "add something" means check to see if the index is in the shape we need (a datastream, not an index, the mappings are right, etc), and then be able to inform the user.

We could probably check at startup as well.

Since a customer could presumably fix this without rebooting Kibana, it doesn't feel like we'd want to do something like check at startup and disable reporting completely. But making it noisy seems good.

@pmuellr pmuellr added Feature:Reporting:Framework Reporting issues pertaining to the overall framework Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) labels Feb 18, 2025
@elasticmachine
Copy link
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Reporting:Framework Reporting issues pertaining to the overall framework Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
None yet
Development

No branches or pull requests

2 participants