elastic / elastic/elastic-package
Integration CI build `elastic-package stack up` does not have default alert index
- Dominant language
- Go
- Stars
- 72
- Forks
- 141
- Avg merge
- 19h 42m
- Merged PRs (30d)
- 55
Description
[This Integration](https://github.com/elastic/integrations/pull/4019) uses transforms; the source index for one of the transforms is the default alerts index in Security - `.alerts-security.alerts-default`.
`.alerts-security.alerts-default` is only created in a new stack once the _first_ alert is generated. Hence, when I was using `elastic-package stack up` for development, a workaround is creating a rule that runs when `@timestamp: *` so that _any_ alert is generated, thus causing `.alerts-security.alerts-default` to be created. After that, I will then `elastic-package install` the Host Risk Score package. This worked well.
However, on the repo, the tests and CI are fresh Elastic stacks, and don't have the default alerts index, and so I get the build error: `no such index [.alerts-security.alerts-default];`
Is there any way for the build CI test environment Elastic stack to have that index created?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the `elastic-package stack up` entry point and the integration build CI environment described in the issue. Trace how a fresh Elastic stack is prepared before `elastic-package install`, then verify the build succeeds when `.alerts-security.alerts-default` exists without manually generating an alert.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- ci-cd, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100