Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Osquerybeat: Return the query result count with the action response #28576

Merged
merged 2 commits into from
Oct 21, 2021

Conversation

aleksmaus
Copy link
Contributor

What does this PR do?

Return the query result count with the action response

This would allow osquery UI to detect when all the results are received and stop showing the progress indicator.

Related issues

Screenshots

Confirmed mapping is created:
Screen Shot 2021-10-20 at 4 10 34 PM

Confirmed the data is indexed and searchable with osquerybeat that now provides the number of rows returned by the query:
Screen Shot 2021-10-20 at 4 10 58 PM

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Oct 20, 2021
@@ -97,11 +99,12 @@ func (a *actionHandler) executeQuery(ctx context.Context, index string, ac actio

if err != nil {
a.log.Errorf("Failed to execute query, err: %v", err)
return err
return 0, err
}

a.log.Debugf("Completed query in: %v", time.Since(start))

a.publisher.Publish(index, ac.ID, responseID, hits, ac.ECSMapping, req["data"])
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can this have a partial failure on Publish? if so, how are failures to publish surfaced in the publisher?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this API doesn't return errors. publishing is handled by libbeat, including retries and batching. the errors are surfaces through the logs

@elasticmachine
Copy link
Collaborator

elasticmachine commented Oct 20, 2021

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Duration: 56 min 44 sec

❕ Flaky test report

No test was executed to be analysed.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

@aleksmaus
Copy link
Contributor Author

/test

Copy link

@scunningham scunningham left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Better than a snowball.

@aleksmaus aleksmaus merged commit cb9d3a7 into elastic:master Oct 21, 2021
mergify bot pushed a commit that referenced this pull request Oct 21, 2021
aleksmaus added a commit that referenced this pull request Oct 22, 2021
v1v added a commit to v1v/beats that referenced this pull request Oct 26, 2021
…urnalbeat-ci

* upstream/master: (49 commits)
  [CI]: use the downstream packaging pipeline for branches/tags (elastic#28589)
  fix: use declarative style for complete variant of the elastic-agent (elastic#28526)
  x-pack/auditbeat/tracing: fix regexp for kprobe description line (elastic#28609)
  docs: Update `api_key` example on elasticsearch output (elastic#28606)
  chore: add build scripts to CODEOWNERS (elastic#28615)
  Osquerybeat: Fix host_processes missing cmdline arguments (elastic#28622)
  Add note about changes to regexp package in Golang (elastic#28616)
  CI: nightly/weekly builds for 7.x targeting 7.16 instead (elastic#28612)
  Osquerybeat: Fix extenstion unable to start on windows (elastic#28598)
  Osquerybeat: Return the query result count with the action response (elastic#28576)
  Agent: Allow custom response properties in the action response (elastic#28575)
  [Heartbeat] Only setuid in elastic-agent image (elastic#28577)
  Fix formatting of `mapStateJSON` and `layerListJSON` in dashboard assets (elastic#28530)
  CI: refactor the run e2e build (elastic#28502)
  Use fsnotify with long windows name-safe changes (elastic#28517)
  Remove unneeded mergify config
  backport: Add 7.16 branch (elastic#28560)
  Add proxy_url support to threatintel module's malwarebazaar fileset (elastic#28533)
  Osquerybeat: Implement host_users, host_groups, host_processes tables as a part of our osquery_extension. (elastic#28434)
  [Heartbeat] Make run_once syntax a boolean (elastic#28548)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants