elastic / elastic/integrations
[problemchild][dga] Trained model install fails: input.field_names exceeds new ES 100-field limit
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
## Summary
Installing the `problemchild` and `dga` packages fails with an Elasticsearch validation error introduced in ES [#150227](https://github.com/elastic/elasticsearch/pull/150227) (merged 2026-06-16).
## Error
```
action_request_validation_exception: Validation Failed: 1: [input.field_names] must contain not more than 100 field names.
```
## Root cause
ES PR [#150227](https://github.com/elastic/elasticsearch/pull/150227) added a hard cap of 100 entries on `input.field_names` when creating a trained model, to prevent uncontrolled memory allocation and OOMs.
Both affected trained models exceed this limit:
| Package | Model file | `input.field_names` count |
|---|---|---|
| `problemchild` | `problemchild_20210526_1.0.json` | **476** |
| `dga` | `dga_1611725_2.0.json` | **185** |
Neither model file has changed since it was originally added to the repo.
## Affected versions
- `problemchild` 3.0.2 and all previous versions
- `dga` 3.0.1 and all previous versions
- Any Elasticsearch version that includes PR #150227
## Impact
The daily [Kibana Fleet package install CI test](https://buildkite.com/elastic/kibana-fleet-packages/builds/1669#019ed5ad-96da-4ec4-89df-0006bae505a7) (`x-pack/platform/test/fleet_packages/tests/install_all.ts`) has been failing since 2026-06-17/18 when the new ES build was picked up.
## Fix
The trained models need to be updated to have ≤ 100 `input.field_names`, or retrained/restructured to comply with the new limit.
cc @elastic/sec-applied-ml
Contributor guide
Research direction
Inspect problemchild_20210526_1.0.json and dga_1611725_2.0.json, focusing on their input.field_names entries and how the trained models are packaged. Run the install check in x-pack/platform/test/fleet_packages/tests/install_all.ts. Done means both models comply with the 100-field limit and the package installation test passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elasticsearch
- Domain
- ci-cd, machine-learning
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100