opensearch-project / opensearch-project/security-analytics

[BUG] Missing indices / datastreams in Configure logs scan

Open
#1,329 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Java
Stars
111
Forks
111
Avg merge
1d 17h
Merged PRs (30d)
13

Description

What is the bug?
I only have access to security-auditlog-* indices in Select Index/Aliases in Configure logs scan

How can one reproduce the bug?
Steps to reproduce the behavior:

  1. Go to 'Security Analytics --> Threat Intelligence --> Configure scan'
  2. Click on 'Select Indexes/Aliases'
  3. Datastreams and indices starting with '.' are not displayed

What is the expected behavior?
A clear and concise description of what you expected to happen.

What is your host/environment?

  • OS: Debian 12
  • Version 2.16 and 2.17
  • Plugins

Do you have any additional context?
It seems that there is an issue with Datastreams and Indices starting with . (so it's impossible to add indices created by datastreams)
It's recommended to use Aliases and Datastreams, but none of them are displayed in the dropdown list...
[Aliases](https://opensearch.org/docs/latest/im-plugin/index-alias) and [data streams](https://opensearch.org/docs/latest/im-plugin/data-streams/) are recommended for optimal threat intel scans.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue in Security Analytics → Threat Intelligence → Configure scan, then inspect the Select Indexes/Aliases flow for how indices, aliases, and datastreams are listed. Done means indices and datastreams whose names start with a dot, including those created by datastreams, appear in the dropdown and can be selected.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.