elastic / elastic/integrations

[problemchild][dga] Trained model install fails: input.field_names exceeds new ES 100-field limit

Open
#19,679 1 comment 1 reaction 0 assignees View on GitHub
bug Team:Security-Applied ML
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

## Summary

Installing the `problemchild` and `dga` packages fails with an Elasticsearch validation error introduced in ES [#150227](https://github.com/elastic/elasticsearch/pull/150227) (merged 2026-06-16).

## Error

```
action_request_validation_exception: Validation Failed: 1: [input.field_names] must contain not more than 100 field names.
```

## Root cause

ES PR [#150227](https://github.com/elastic/elasticsearch/pull/150227) added a hard cap of 100 entries on `input.field_names` when creating a trained model, to prevent uncontrolled memory allocation and OOMs.

Both affected trained models exceed this limit:

| Package | Model file | `input.field_names` count |
|---|---|---|
| `problemchild` | `problemchild_20210526_1.0.json` | **476** |
| `dga` | `dga_1611725_2.0.json` | **185** |

Neither model file has changed since it was originally added to the repo.

## Affected versions

- `problemchild` 3.0.2 and all previous versions
- `dga` 3.0.1 and all previous versions
- Any Elasticsearch version that includes PR #150227

## Impact

The daily [Kibana Fleet package install CI test](https://buildkite.com/elastic/kibana-fleet-packages/builds/1669#019ed5ad-96da-4ec4-89df-0006bae505a7) (`x-pack/platform/test/fleet_packages/tests/install_all.ts`) has been failing since 2026-06-17/18 when the new ES build was picked up.

## Fix

The trained models need to be updated to have ≤ 100 `input.field_names`, or retrained/restructured to comply with the new limit.

cc @elastic/sec-applied-ml

Contributor guide

Open the contributing guide

Research direction

Inspect problemchild_20210526_1.0.json and dga_1611725_2.0.json, focusing on their input.field_names entries and how the trained models are packaged. Run the install check in x-pack/platform/test/fleet_packages/tests/install_all.ts. Done means both models comply with the 100-field limit and the package installation test passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
elasticsearch
Domain
ci-cd, machine-learning
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.