[Security Solution] .siem-signals index continuously rolls over if version in template is higher than built in version #84981
Labels
bug
Fixes for quality problems that affect the customer experience
Feature:Detection Alerts
Security Solution Detection Alerts Feature
impact:low
Addressing this issue will have a low level of impact on the quality/strength of our product.
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Kibana version:
7.10
Describe the bug:
If the .siem-signals template is manually upgraded to a version higher than the built in version and also sets
mapping._meta.version
to a version other than the built in version (SIGNALS_TEMPLATE_VERSION
) then we will roll over the .siem-signals index every time an admin visits the detections page. This is due to the !== check here, whereas the template uses < to check if it needs to be upgraded here.In this situation the template does not get upgraded but it continuously tries to upgrade the index, using the same template repeatedly.
Steps to reproduce:
version
andmappings._meta.version
are both greater than the built inSIGNALS_TEMPLATE_VERSION
Expected behavior:
Rollover should only occur automatically on loading the detections page if the index version is less than the built in version.
The text was updated successfully, but these errors were encountered: