elastic / elastic/fleet-server

malformed docs in bulk requests interfere with normal operations

Open
#3,160 0 comments 0 reactions 0 assignees View on GitHub
bug Team:Elastic-Agent-Control-Plane
Dominant language
Go
Stars
113
Forks
117
Avg merge
1d 16h
Merged PRs (30d)
112

Description

fleet-server makes a few different bulk reads where all documents retrieved are immediately parsed to structs defined in `model/schema.json`. For example, [when we query for the latest policies](https://github.com/elastic/fleet-server/blob/main/internal/pkg/dl/policies.go#L61) or [handling actions](https://github.com/elastic/fleet-server/blob/main/internal/pkg/dl/actions.go#L214).

If a single document fails to unmarshal correctly, we return `nil, err` even if it's a single doc out of a large set.
This will stop the fleet-server from processing policies or actions, which could result in agents going offline.
For example, an agent with the policy `A` checks in, policy `A` is queried and parsed correctly, yet policy `B` fails to parse due to an incorrect attribute, fleet-server will return a 503 error to the agent.

We should change how bulk returns are handled to either:
1. log and ignore the parsing error
or
2. return the parsed hits with any errors (using `errors.Join`) and have the callers handle these cases

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.