[Endpoint] Encode the index of the alert in the id response

[jonathan-buttner]

Summary

Retrieving alerts from ES is currently not working because of data streams. To reproduce this issue:

1. Checkout master
2. Log in to kibana
3. Connect a live endpoint
4. Generate an alert
5. Attempt to view the alert in the endpoint app

This will not happen when using the resolver data generator because it uses a mapping file which forces the index to not use data streams.

You should see the following in the UI

Alert UI Failure

The issue is that the ingest manager leverages v2 templates and data streams for the data sent by an endpoint. The endpoint binary is configured to send event data and alerts to event-endpoint-1. Instead of creating a normal index in ES, a data stream will be created and the actual index will be something like events-endpoint-1-000001. When the alert details server code tries to retrieve the alert it uses a hard coded index value here: https://github.com/elastic/kibana/blob/master/x-pack/plugins/endpoint/common/alert_constants.ts#L19 (events-endpoint-1) and uses the ES Get api for retrieving the alert by it's ID.

This fails with the following error:

{
  "msg": "[illegal_argument_exception] The provided expression [events-endpoint-1] matches a data stream, specify the corresponding concrete indices instead.",
  "path": "/events-endpoint-1/_doc/5IPTKHIBMyjTtvMm6Xmj",
  "query": {},
  "statusCode": 400,
  "response": "{\"error\":{\"root_cause\":[{\"type\":\"illegal_argument_exception\",\"reason\":\"The provided expression [events-endpoint-1] matches a data stream, specify the corresponding concrete indices instead.\"}],\"type\":\"illegal_argument_exception\",\"reason\":\"The provided expression [events-endpoint-1] matches a data stream, specify the corresponding concrete indices instead.\"},\"status\":400}"
}

To solve this, the index will now be encoded in the response id field.

Testing

Connect a live endpoint and trigger an alert. You should be able to see the alert in resolver.

[elasticmachine]

Pinging @elastic/endpoint-app-team (Feature:Endpoint)

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 3720a33

History

• 💔 Build #48742 failed 77848b3

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream