[RAC][Rule Registry] Implement RuleDataService.getReader() that skips index bootstrapping #111173
Labels
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Theme: rac
label obsolete
Parent ticket: #101016
Summary
Background: #108115 (comment)
The
observability
plugin initializes an instance ofRuleDataClient
in order to only be able to read from all observability indices (observability.logs
,observability.apm
, etc). It does this by calling:This doesn't lead to any index bootstrapping only because no component templates and other resources are specified. However, this is not super safe and it misuses this method.
We need to expose a separate method for getting a reader that would not even try to check if any bootstrapping is necessary:
The text was updated successfully, but these errors were encountered: