Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Can't upsert index template for concrete index while creating detectors on datastream indices #1415

Open
kritikashahi opened this issue Nov 11, 2024 · 2 comments
Labels
bug Something isn't working

Comments

@kritikashahi
Copy link

kritikashahi commented Nov 11, 2024

What is the bug?
When creating detectors in security analytics on datastream indices, it detector creation fails with error: Can't upsert index template for concrete index. Also the datastream indices are not showing up in dropdown for Select indexes/aliases.

How can one reproduce the bug?
Steps to reproduce the behavior:

  1. Go to security analytics -> create a detector.
  2. enter the custom datastream index pattern (as datastreams are not showing up)
  3. fill other details, click on next
  4. Add alert trigger details and click on create detector.

What is the expected behavior?
The detector should be created successfully

What is your host/environment?

  • OS: linux
  • Version: 2.16.0
  • Plugins: security analytics

Additional Context
Detector is created successfully when using a specific data stream index instead of using the datastream name (pattern) to create detector

@kritikashahi kritikashahi added bug Something isn't working untriaged labels Nov 11, 2024
@lyradc
Copy link

lyradc commented Nov 12, 2024

When attempting to create a detector referencing a datastream name the following error is returned:
[illegal_argument_exception] composable template [datastream] with index patterns [datastream_ds*], priority [150] would cause data streams [datastream_ds] to no longer match a data stream template

When attempting to create a detector referencing a datastream's backing index the detector is created but then the following error is presented:
image

@dblock dblock removed the untriaged label Dec 2, 2024
@dblock
Copy link
Member

dblock commented Dec 2, 2024

[Catch All Triage - 1, 2, 3]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants