opensearch-project / opensearch-project/security-analytics
[BUG] Missing indices / datastreams in Configure logs scan
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 111
- Forks
- 111
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 13
Description
What is the bug?
I only have access to security-auditlog-* indices in Select Index/Aliases in Configure logs scan
How can one reproduce the bug?
Steps to reproduce the behavior:
- Go to 'Security Analytics --> Threat Intelligence --> Configure scan'
- Click on 'Select Indexes/Aliases'
- Datastreams and indices starting with '.' are not displayed
What is the expected behavior?
A clear and concise description of what you expected to happen.
What is your host/environment?
- OS: Debian 12
- Version 2.16 and 2.17
- Plugins
Do you have any additional context?
It seems that there is an issue with Datastreams and Indices starting with . (so it's impossible to add indices created by datastreams)
It's recommended to use Aliases and Datastreams, but none of them are displayed in the dropdown list...
[Aliases](https://opensearch.org/docs/latest/im-plugin/index-alias) and [data streams](https://opensearch.org/docs/latest/im-plugin/data-streams/) are recommended for optimal threat intel scans.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue in Security Analytics → Threat Intelligence → Configure scan, then inspect the Select Indexes/Aliases flow for how indices, aliases, and datastreams are listed. Done means indices and datastreams whose names start with a dot, including those created by datastreams, appear in the dropdown and can be selected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100