elastic / elastic/detection-rules

[Rule Tuning] Fix Generic Logs index in ESQL rules

Open
#5,425 0 comments 0 reactions 1 assignee Claimed by @Samirbous View on GitHub
Rule: Tuning Team: TRADE
Dominant language
Python
Stars
2.7k
Forks
696
Avg merge
4d 17h
Merged PRs (30d)
87

Description

### Description

ES|QL rules with generic logs search query scope`from logs-*` may fail if there are conflicting field types or missing fields.

https://github.com/search?q=repo%3Aelastic%2Fdetection-rules+%22from+logs-*%22+path%3A%2F%5Erules%5C%2Fcross-platform%5C%2F%2F&type=code

Review telem in the next 2/3 weeks for this rule https://github.com/elastic/detection-rules/pull/5416 (fixed by using specific index patterns), if no issues replicate to the other impacted rules.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.