skip query of detections page when we do not have .siem-signals index #74580
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Pinging @elastic/siem (Team:SIEM) |
f4ce231 to
a925deb
Compare
spong
approved these changes
Aug 6, 2020
There was a problem hiding this comment.
Checked out and tested locally and sorting is working without a toaster error on both the Detections and Rule Details pages. Also did a little regression testing around the timeline event type selector and all looked good there as well! 👍 Thanks for clearing this one up for our users @XavierM! LGTM! 🌈 🦋
rylnd
reviewed
Aug 6, 2020
x-pack/plugins/security_solution/public/timelines/containers/helpers.ts
Outdated
Show resolved
Hide resolved
💚 Build SucceededBuild metrics@kbn/optimizer bundle module count
async chunks size
History
To update your PR or re-run it, just comment with: |
XavierM
added a commit
to XavierM/kibana
that referenced
this pull request
Aug 6, 2020
…elastic#74580) * skip query of detections page when we do not have .siem-signals index * review I
XavierM
added a commit
to XavierM/kibana
that referenced
this pull request
Aug 6, 2020
…elastic#74580) * skip query of detections page when we do not have .siem-signals index * review I
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR is to resolve this issue #74180
If you look at the error toaster you will see this:
The root of the issue looks to be that when timeline mounts its self it is causing initial queries against the
sime:defaultIndexand does not have the siem signals:Later queries will be the correct ones which will be just the siem-signals index and not include these extra indexes on page load. We really want to eliminate duplicate queries of timeline when it first mounts and want to eliminate it from querying the
siem:defaultIndexon page load. You do run the risk of the second query taking longer than the first and possibly wrong data on your visualization:Checklist