elastic / elastic/integrations

[LogsDB] [Subscription basic] [amazon_security_lake] Failing test daily: script test: routed_data_streams in amazon_security_lake.event

Closed
#21,224 0 comments 0 reactions 0 assignees View on GitHub
automation flaky-test
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

- Stack version: maximum of either the version used in PR builds or 8.17.0 (GA version for LogsDB index mode)
- LogsDB: enabled
- Subscription: basic
- Package: amazon_security_lake
- Failing test: script test: routed_data_streams
- DataStream: event
- Owners:
- @elastic/security-service-integrations
- @elastic/sit-crest-contractors

Failure:
```
routed_data_streams.txt:26: setting up service: could not boot up service using Docker Compose: running Docker Compose up command failed: exit status 18: pull access denied for minio/minio, repository does not exist or may require 'docker login': denied: requested access to the resource is denied: RUN routed_data_streams
# Verify that events from the event data stream are routed to OCSF-category-specific
# data streams via routing rules.
#
# The test data in MinIO provides one event per OCSF category_uid value (1–6),
# derived from the pipeline test fixtures:
# - category_uid 1 → amazon_security_lake.system_activity (rerouted)
# - category_uid 2 → amazon_security_lake.findings (rerouted)
# - category_uid 3 → amazon_security_lake.iam (rerouted)
# - category_uid 4 → amazon_security_lake.network_activity (rerouted)
# - category_uid 5 → amazon_security_lake.discovery (rerouted)
# - category_uid 6 → amazon_security_lake.application_activity (rerouted)
#
#
```

First build failed: https://buildkite.com/elastic/integrations/builds/49558

Contributor guide

Open the contributing guide

Research direction

Start with the routed_data_streams test output and the Docker Compose setup used by the amazon_security_lake package. Check why the MinIO service cannot be pulled, then run the script test: routed_data_streams again. Done means the service boots and the test verifies events are routed to the six OCSF-category-specific data streams.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker-compose
Domain
devops, testing
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.