Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add known issue and resolution for Fleet's KQL processing changes #523

Merged
merged 2 commits into from
Sep 29, 2023
Merged

Add known issue and resolution for Fleet's KQL processing changes #523

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
42d4792
Add known issue and resolution for Fleet's KQL processing changes
kilfoyle Sep 28, 2023
88e443d
remove expected behavior statement
kilfoyle Sep 29, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions docs/en/ingest-management/release-notes/release-notes-8.10.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -323,6 +323,51 @@ _Example 3: Ansible_

====

[[known-issue-166553]]
.Filtering Elastic Agents in Kibana generates an "Error fetching agents" message
[%collapsible]
====

*Details*

A {kibana-ref}/kuery-query.html[KQL query] in a Fleet search field now returns a `400` error when the query is not valid.

Previously, the search fields would accept any type of query, but with the merge of {kibana-pull}161064[#161064] any type of KQL sent to {fleet} needs to have a valid field name, otherwise it returns an error.

Note that this is expected behaviour.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm just not sure if we should keep this statement here, as many users are seeing this as a regression and we are going to find a solution for it. What do you think to remove it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point! I've removed the sentence (via 88e443d).


*Cause* +

Entering an invalid KQL query on one of the {fleet} KQL search fields or through the API produces the error.

Affected search fields in the {fleet} UI:

* Agent list
* Agent policies
* Enrollment Keys

Affected endpoints in the <<fleet-api-docs>> (these are the endpoints that accept the parameter `ListWithKuery`):

* `GET api/fleet/agents`
* `GET api/fleet/agent_status`
* `GET api/fleet/agent_policies`
* `GET api/fleet/package_policies`
* `GET api/fleet/enrollment_api_keys`
* `GET api/fleet/agent_status`

*Impact* +

To avoid getting the `400` error, the queries should be valid.

For instance, entering the query `8.10.0` results in an error. The correct query should be: `local_metadata.agent.version="8.10.0"`.

As another example, when viewing the *Agents* tab in *Fleet*, typing a hostname such as `a0c8c88ef2f5` in the search field results in an error. The correct query should have the correct field name, taken from among the allowed ones, for example `local_metadata.host.hostname: a0c8c88ef2f5`.

The list of available field names is visible by clicking on any of the search fields.

====


[discrete]
[[new-features-8.10.0]]
=== New features
Expand Down