fleet-server package

[ruflin]

For fleet-server to work properly, quite a few assets need to be loaded in advance. Currently the setup is done by fleet-server itself but instead it should be done by Kibana. As the assets to be installed are mainly templates this can be done with a package to not have to duplicate the logic.

This issue is to discuss details around the package and track the implementation.

Few thoughts around the package:

• The assets are for a hidden or system index. We added support for hidden indices recently, would loading it for system indices change anyhting?
• Should we follow the indexing strategy but for hidden indices
• Any assets we need not supported yet by the package installation
• When should this package be installed? Also on startup? This should also be a package the user cannot remove.

[ruflin]

@aleksmaus @nchaulet Here the issue to track the package for the fleet-server. I assigned @aleksmaus to it as I think he already built a package in the past. Happy to help with this one. I listed a few questions above we should also discuss first, I'm sure there are more, please add them to the list.

[elasticmachine]

Pinging @elastic/ingest-management (Team:Ingest Management)

[aleksmaus]

@ruflin I haven't build the kibana package that boostraps the indices before yet.
Any good examples? What happens to the indices if the package is uninstalled?

[ruflin]

@aleksmaus Sorry, I thought you built the one for osquery. A good starting point is here https://github.com/elastic/integrations/blob/master/CONTRIBUTING.md#tips-for-building-integrations and look at some of the existing packages. We should not allow users to uninstall the package, we do the same for endpoint for example.

[aleksmaus]

@aleksmaus Sorry, I thought you built the one for osquery. A good starting point is here https://github.com/elastic/integrations/blob/master/CONTRIBUTING.md#tips-for-building-integrations and look at some of the existing packages. We should not allow users to uninstall the package, we do the same for endpoint for example.

I did, but it doesn't bootstrap any indices. Will dig.

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!