Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Alerting] indexThreshold /_indices API returns 500 for CCS index pattern #59889

Closed
pmuellr opened this issue Mar 11, 2020 · 1 comment · Fixed by #60702
Closed

[Alerting] indexThreshold /_indices API returns 500 for CCS index pattern #59889

pmuellr opened this issue Mar 11, 2020 · 1 comment · Fixed by #60702
Assignees
@pmuellr
Labels
bug Fixes for quality problems that affect the customer experience Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@pmuellr
Copy link
Member

pmuellr commented Mar 11, 2020

I tried creating an index threshold alert using the following text in the index field:

es-apm-sys-sim,cluster_one:twitter,cluster_two:twitter

The idea was to try using CCS syntax, make sure nothing breaks. Here's some doc on CCS syntax: https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-cross-cluster-search.html#ccs-search-multi-remote-cluster

The UI doesn't accept it, has the red "Index is required." below the field.

Looking in the APM, I can see the following request got made:

500 - POST /api/alerting_builtins/index_threshold/_indices

That endpoint made the following calls:

200 - GET localhost:9200/*es-apm-sys-sim%2Ccluster_one%3Atwitter%2Ccluster_two%3Atwitter*/_alias
403 - POST localhost:9200/*es-apm-sys-sim%2Ccluster_one%3Atwitter%2Ccluster_two%3Atwitter*/_search

Presumably, the _alias call returned an empty array. The 403 response - we'll need to get more info; guessing it might be that those clusters aren't defined.
@pmuellr pmuellr added Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) labels Mar 11, 2020
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

@mikecote mikecote added the bug Fixes for quality problems that affect the customer experience label Mar 16, 2020
@pmuellr pmuellr self-assigned this Mar 19, 2020
@pmuellr pmuellr mentioned this issue Mar 19, 2020
Merged
1 task
pmuellr added a commit to pmuellr/kibana that referenced this issue Mar 20, 2020
@pmuellr
[Alerting]: harden APIs of built-in alert index-threshold
8e78f89 
resolves elastic#59889

The index threshold APIs - used by both the index threshold UI and the
alert executor - were returning errors (500's from http endpoints) when
getting errors from ES.

These have been changed so that the error is logged as a warning, and the
relevant API returns an "empty" result.

Another 500 response was found while experimenting with this.  Apparently
the date_range agg requires a date format to be passed in if the date format
in ES is not an ISO date.  The repro on this was to select the `.security`
alias (or it's index) within the index threshold alert UI, and then select
one of it's date fields.
pmuellr added a commit that referenced this issue Mar 20, 2020
@pmuellr
[Alerting]: harden APIs of built-in alert index-threshold (#60702)
5efd59b 
resolves #59889

The index threshold APIs - used by both the index threshold UI and the
alert executor - were returning errors (500's from http endpoints) when
getting errors from ES.

These have been changed so that the error is logged as a warning, and the
relevant API returns an "empty" result.

Another 500 response was found while experimenting with this.  Apparently
the date_range agg requires a date format to be passed in if the date format
in ES is not an ISO date.  The repro on this was to select the `.security`
alias (or it's index) within the index threshold alert UI, and then select
one of it's date fields.
pmuellr added a commit to pmuellr/kibana that referenced this issue Mar 20, 2020
@pmuellr
[Alerting]: harden APIs of built-in alert index-threshold (elastic#60702
4cc3c17 
)

resolves elastic#59889

The index threshold APIs - used by both the index threshold UI and the
alert executor - were returning errors (500's from http endpoints) when
getting errors from ES.

These have been changed so that the error is logged as a warning, and the
relevant API returns an "empty" result.

Another 500 response was found while experimenting with this.  Apparently
the date_range agg requires a date format to be passed in if the date format
in ES is not an ISO date.  The repro on this was to select the `.security`
alias (or it's index) within the index threshold alert UI, and then select
one of it's date fields.
pmuellr added a commit that referenced this issue Mar 20, 2020
@pmuellr
[Alerting]: harden APIs of built-in alert index-threshold (#60702) (#…
f1965eb 
…60813)

resolves #59889

The index threshold APIs - used by both the index threshold UI and the
alert executor - were returning errors (500's from http endpoints) when
getting errors from ES.

These have been changed so that the error is logged as a warning, and the
relevant API returns an "empty" result.

Another 500 response was found while experimenting with this.  Apparently
the date_range agg requires a date format to be passed in if the date format
in ES is not an ISO date.  The repro on this was to select the `.security`
alias (or it's index) within the index threshold alert UI, and then select
one of it's date fields.
@kobelb kobelb added the needs-team Issues missing a team label label Jan 31, 2022
@botelastic botelastic bot removed the needs-team Issues missing a team label label Jan 31, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@pmuellr pmuellr

Labels
bug Fixes for quality problems that affect the customer experience Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Alerting]: harden APIs of built-in alert index-threshold pmuellr/kibana
4 participants
@pmuellr @kobelb @mikecote @elasticmachine