Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security solution] Stops page from crashing when there is a fields error in the stackBy component #168411

Merged
merged 4 commits into from
Oct 10, 2023

Conversation

stephmilovic
Copy link
Contributor

@stephmilovic stephmilovic commented Oct 9, 2023

Summary

Resolves #149540

We've been seeing SDHs reporting a stack overflow error that breaks the page.

The error points to a valid problem, but we wanted to improve the Alerts page UX to prevent the app to crash in these situations, making the application more resilient and showing some meaningful message to the customer when this happens.

Testing

Start by running local es from a snapshot and local kibana. Unless you want to edit some paths in scripts the best way to do this is to run kibana with a base path and defining that base path to be kbn by adding this line to your kibana.dev.yml:

server.basePath: '/kbn'

@e40pud created a super helpful script for generating indices with huge amounts of fields: https://github.com/elastic/kibana/tree/main/x-pack/plugins/security_solution/scripts/mappings

Using Huge Indices tool, cd into the directory x-pack/plugins/security_solution/scripts/mappings and run the following commands:

  1. Creates a huge field mapping. Uses 371k fields because thats what our most recent SDH client had. Defines the index as filebeat- so the index will become part of our Security Data View without changes to the advanced settings
    node mappings_generator.js --fieldsCount=371675 --indexCount=1 --indexPrefix='filebeat-' --unmappedRate=.2 --buckets=10 --outputDirectory='test_unmapped'
    
  2. Load the mappings into an index in your environment
    node mappings_loader.js --mappings-dir='test_unmapped' --es-url=http://elastic:changeme@localhost:9200 --kibana-url=http://elastic:changeme@localhost:5601/kbn/ap
    

Now check the overview page. You should see our new error coming up. If you check out main, you will see the crash.

Before

Screenshot 2023-10-09 at 2 50 55 PM

After

Screenshot 2023-10-09 at 2 43 48 PM Screenshot 2023-10-09 at 2 42 51 PM

@stephmilovic stephmilovic added release_note:fix Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.12.0 labels Oct 9, 2023
@stephmilovic stephmilovic requested a review from a team as a code owner October 9, 2023 20:59
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

}, [allFields, useLensCompatibleFields]);
return useMemo(() => stackByFieldOptions, [stackByFieldOptions]);

return useCallback(() => {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

useCallback so this does not run right away, just when called

try {
return getAggregatableFields(getAllFieldsByName(browserFields), useLensCompatibleFields);
} catch (err) {
addError(err, {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@paulewing what do you think of this message? Looks like:
Screenshot 2023-10-09 at 3 02 18 PM

@janmonschke
Copy link
Contributor

Thanks for adding this fix, @stephmilovic 🎉
Some tests might need updating with your changes but otherwise looks good to me.

@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 13.0MB 13.0MB +1.5KB

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@stephmilovic stephmilovic merged commit 7776ac4 into elastic:main Oct 10, 2023
@kibanamachine kibanamachine added the backport:skip This commit does not require backporting label Oct 10, 2023
dej611 pushed a commit to dej611/kibana that referenced this pull request Oct 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:skip This commit does not require backporting release_note:fix Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting Security Solution Threat Hunting Team v8.12.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Security Solution] Improve Alerts page to prevent "max stack size exceeded" error
5 participants