elastic / elastic/detection-rules
[Rule Tuning] Fix Generic Logs index in ESQL rules
Open
Rule: Tuning
Team: TRADE
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 696
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 87
Description
### Description
ES|QL rules with generic logs search query scope`from logs-*` may fail if there are conflicting field types or missing fields.
https://github.com/search?q=repo%3Aelastic%2Fdetection-rules+%22from+logs-*%22+path%3A%2F%5Erules%5C%2Fcross-platform%5C%2F%2F&type=code
Review telem in the next 2/3 weeks for this rule https://github.com/elastic/detection-rules/pull/5416 (fixed by using specific index patterns), if no issues replicate to the other impacted rules.
Contributor guide
Assessment
This issue has not been assessed yet.