Enable to select whether to prohibit enhancement from being run on alert information to be written back to ES #2542
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background and problem
With running enhancements, the data type of elements in a match could be changed from original one due to the enhancements.
As a result, when the data type that Elasticsearch's writeback_index expects does not match the data type in a match to be written to ES, trying to write alert info to Elasticsearch will fail.
This problem especially tends to occur when using enhancements that change the format of @timestamp (or timestamp_field).
In that case, the following error would appear.
Several related issues have also been reported.
#1047 #2036
Cause
The cause of this problem is that, in the current code, it is the alert info modified by enhancements that will be written back to ES.
Solution
Add an option which realizes that enhancements will be run only on the content of alerts send by Alerters, whereas info about the alerts to be written back into Elasticsearch will not be processed by enhancements.