elastic / elastic/elastic-package

Integration CI build `elastic-package stack up` does not have default alert index

Open
#1,097 1 comment 0 reactions 0 assignees View on GitHub
build-failures help wanted Team:Ecosystem
Dominant language
Go
Stars
72
Forks
141
Avg merge
19h 42m
Merged PRs (30d)
55

Description

[This Integration](https://github.com/elastic/integrations/pull/4019) uses transforms; the source index for one of the transforms is the default alerts index in Security - `.alerts-security.alerts-default`.

`.alerts-security.alerts-default` is only created in a new stack once the _first_ alert is generated. Hence, when I was using `elastic-package stack up` for development, a workaround is creating a rule that runs when `@timestamp: *` so that _any_ alert is generated, thus causing `.alerts-security.alerts-default` to be created. After that, I will then `elastic-package install` the Host Risk Score package. This worked well.

However, on the repo, the tests and CI are fresh Elastic stacks, and don't have the default alerts index, and so I get the build error: `no such index [.alerts-security.alerts-default];`

Is there any way for the build CI test environment Elastic stack to have that index created?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the `elastic-package stack up` entry point and the integration build CI environment described in the issue. Trace how a fresh Elastic stack is prepared before `elastic-package install`, then verify the build succeeds when `.alerts-security.alerts-default` exists without manually generating an alert.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
ci-cd, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.