match namespace suffixes for endpoint action and response indices

fixes elastic/issues/123707
ashokaditya · Jan 25, 2022 · f006eb1 · f006eb1
1 parent eb6b4e4
commit f006eb1
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/x-pack/plugins/security_solution/server/endpoint/utils/audit_log_helpers.ts b/x-pack/plugins/security_solution/server/endpoint/utils/audit_log_helpers.ts
@@ -35,8 +35,9 @@ const actionsIndices = [AGENT_ACTIONS_INDEX, ENDPOINT_ACTIONS_INDEX];
 // search all responses indices irrelevant of namespace
 const responseIndices = [AGENT_ACTIONS_RESULTS_INDEX, ENDPOINT_ACTION_RESPONSES_INDEX_PATTERN];
 export const logsEndpointActionsRegex = new RegExp(`(^\.ds-\.logs-endpoint\.actions-default-).+`);
+// matches index names like .ds-.logs-endpoint.action.responses-name_space---suffix-2022.01.25-000001
 export const logsEndpointResponsesRegex = new RegExp(
-  `(^\.ds-\.logs-endpoint\.action\.responses-default-).+`
+  `(^\.ds-\.logs-endpoint\.action\.responses-\\w+-).+`
 );
 const queryOptions = {
   headers: {