-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Osquerybeat: Return the query result count with the action response #28576
Osquerybeat: Return the query result count with the action response #28576
Conversation
@@ -97,11 +99,12 @@ func (a *actionHandler) executeQuery(ctx context.Context, index string, ac actio | |||
|
|||
if err != nil { | |||
a.log.Errorf("Failed to execute query, err: %v", err) | |||
return err | |||
return 0, err | |||
} | |||
|
|||
a.log.Debugf("Completed query in: %v", time.Since(start)) | |||
|
|||
a.publisher.Publish(index, ac.ID, responseID, hits, ac.ECSMapping, req["data"]) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can this have a partial failure on Publish
? if so, how are failures to publish surfaced in the publisher?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this API doesn't return errors. publishing is handled by libbeat, including retries and batching. the errors are surfaces through the logs
/test |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Better than a snowball.
…28576) (#28595) (cherry picked from commit cb9d3a7) Co-authored-by: Aleksandr Maus <[email protected]>
…urnalbeat-ci * upstream/master: (49 commits) [CI]: use the downstream packaging pipeline for branches/tags (elastic#28589) fix: use declarative style for complete variant of the elastic-agent (elastic#28526) x-pack/auditbeat/tracing: fix regexp for kprobe description line (elastic#28609) docs: Update `api_key` example on elasticsearch output (elastic#28606) chore: add build scripts to CODEOWNERS (elastic#28615) Osquerybeat: Fix host_processes missing cmdline arguments (elastic#28622) Add note about changes to regexp package in Golang (elastic#28616) CI: nightly/weekly builds for 7.x targeting 7.16 instead (elastic#28612) Osquerybeat: Fix extenstion unable to start on windows (elastic#28598) Osquerybeat: Return the query result count with the action response (elastic#28576) Agent: Allow custom response properties in the action response (elastic#28575) [Heartbeat] Only setuid in elastic-agent image (elastic#28577) Fix formatting of `mapStateJSON` and `layerListJSON` in dashboard assets (elastic#28530) CI: refactor the run e2e build (elastic#28502) Use fsnotify with long windows name-safe changes (elastic#28517) Remove unneeded mergify config backport: Add 7.16 branch (elastic#28560) Add proxy_url support to threatintel module's malwarebazaar fileset (elastic#28533) Osquerybeat: Implement host_users, host_groups, host_processes tables as a part of our osquery_extension. (elastic#28434) [Heartbeat] Make run_once syntax a boolean (elastic#28548) ...
What does this PR do?
Return the query result count with the action response
This would allow osquery UI to detect when all the results are received and stop showing the progress indicator.
Related issues
Screenshots
Confirmed mapping is created:
Confirmed the data is indexed and searchable with osquerybeat that now provides the number of rows returned by the query: