Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Saved Objects] Add ability to query during saved object migrations #109188

Closed
FrankHassanabad opened this issue Aug 19, 2021 · 7 comments
Closed
Labels
Feature:Detection Alerts Security Solution Detection Alerts Feature Feature:Saved Objects impact:low Addressing this issue will have a low level of impact on the quality/strength of our product. loe:small Small Level of Effort Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc Team:Detections and Resp Security Detection Response Team Team:Security Solution Platform Security Solution Platform Team

Comments

@FrankHassanabad
Copy link
Contributor

FrankHassanabad commented Aug 19, 2021

Parent meta ticket #109169

Describe the feature:
During Kibana migrations in some cases we need to be able to conduct an additional query to get children or other saved objects to migrate or to fix the saved object references array.

The main use case is the exception-list and exception-list-agnostic containers which both have children but those children are not wired up to the main container's saved object references. Right now we use an ID called list_id which is a non saved object. This doesn't hamper or hurt anything if the UUID's are re-generated but this can cause duplicate list and list items when we begin sharing between spaces if the user is importing the same exception list and exception list items to other spaces.

Second use case is that we have saved objects such as the "siem-detection-engine-rule-actions" which is a saved object that has a reference back to the original alert and was put into place by developers a long time ago before the maturity of notifyWhen and throttle options. For us to move away from that, we need a type of "join" where we can query the alerting from it when we migrate.

Describe a specific use case for the feature:
As a platform engineer, when I copy or import the same exception list and its exception list items to two different spaces and then share both of the lists, they should show as completely unique.

As a platform engineer, when I click on "relationships" for the saved objects of an exception list I would expect the exception list to show all of the exception list items as children.

@FrankHassanabad FrankHassanabad added the Team:Detections and Resp Security Detection Response Team label Aug 19, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@FrankHassanabad FrankHassanabad added the Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc label Aug 19, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-core (Team:Core)

@FrankHassanabad FrankHassanabad added Feature:Saved Objects Feature:Detection Alerts Security Solution Detection Alerts Feature labels Aug 19, 2021
@FrankHassanabad FrankHassanabad changed the title Add ability to query during saved object migrations [Saved Objects] Add ability to query during saved object migrations Aug 19, 2021
@rudolf
Copy link
Contributor

rudolf commented Aug 19, 2021

We explored this in #34996 (comment) which also lists some of the complexities/pitfalls.

@pgayvallet
Copy link
Contributor

This seems very similar to #34996.

Querying (against the target index) during the migration is not really doable, as all the objects will not be present when migrating a given one, which is why the approach we thought about was to be able to generate a pre-migration context from the source index before performing the migration, to allow migration function to collect and use state from the source index.

The issue is currently closed because the implications are complex (e.g as you query against the source index, you can't know for sure the shape/version of the objects)

@yctercero
Copy link
Contributor

Closing this ticket as we're not going to be moving in this direction after meeting with core.

@yctercero
Copy link
Contributor

Reopening as it's still something that is desired and worth figuring out if it will be possible.

@yctercero yctercero reopened this Oct 20, 2021
@lukeelmers
Copy link
Member

@yctercero Did we determine whether #34996 would be sufficient for your use case? Asking because that proposal has fewer open questions around it and is more feasible from core's perspective. (Apologies, I can't remember where we landed on that right now).

@exalate-issue-sync exalate-issue-sync bot added impact:low Addressing this issue will have a low level of impact on the quality/strength of our product. loe:small Small Level of Effort labels Nov 4, 2021
@FrankHassanabad FrankHassanabad closed this as not planned Won't fix, can't repro, duplicate, stale Feb 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Detection Alerts Security Solution Detection Alerts Feature Feature:Saved Objects impact:low Addressing this issue will have a low level of impact on the quality/strength of our product. loe:small Small Level of Effort Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc Team:Detections and Resp Security Detection Response Team Team:Security Solution Platform Security Solution Platform Team
Projects
None yet
Development

No branches or pull requests

7 participants