-
Notifications
You must be signed in to change notification settings - Fork 190
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Modules][Dashboard] The toast to reload the page due to the index pattern fields were refreshed appear constatly despite to refresh the page previously. #3918
Comments
ResearchWhen building a visualization requires a non-existent field in the index pattern, an error is caught. At the current source code status, the field name is extracted from the error message and is checked if this exists in the known fields and used to refresh the index pattern fields as an extra field with builtin metadata and the existent fields in the indices. For some modules such as Office 365 or GitHub, the fields used in the visualizations are not included in the builtin known fields and this causes the field can't be found there and can't be added to the index pattern fields despite the field really doesn't exist in the indices. This causes when there is no data related to alerts of these modules, the toast message of Possible solutions
|
Possible solutionFor the approach:
I created the next patch that can be applied in the current status of diff --git a/public/components/visualize/wz-visualize.js b/public/components/visualize/wz-visualize.js
index 2b578f2a9..065aa5a06 100644
--- a/public/components/visualize/wz-visualize.js
+++ b/public/components/visualize/wz-visualize.js
@@ -122,20 +122,16 @@ export const WzVisualize = compose(
this.setState({ expandedVis: this.state.expandedVis === id ? false : id });
};
- refreshKnownFields = async (newField = null) => {
- if (newField && newField.name) {
- this.newFields[newField.name] = newField;
- }
+ refreshKnownFields = async () => {
if (!this.state.hasRefreshedKnownFields) {
// Known fields are refreshed only once per dashboard loading
try {
this.setState({ hasRefreshedKnownFields: true, isRefreshing: true });
if(satisfyPluginPlatformVersion('<7.11')){
- await PatternHandler.refreshIndexPattern(this.newFields);
+ await PatternHandler.refreshIndexPattern();
};
this.setState({ isRefreshing: false });
this.reloadToast();
- this.newFields = {};
} catch (error) {
this.setState({ isRefreshing: false });
const options = {
diff --git a/public/kibana-integrations/kibana-vis.js b/public/kibana-integrations/kibana-vis.js
index ea6460099..2dfe700d3 100644
--- a/public/kibana-integrations/kibana-vis.js
+++ b/public/kibana-integrations/kibana-vis.js
@@ -18,7 +18,7 @@ import { connect } from 'react-redux';
import { LoadedVisualizations } from '../factories/loaded-visualizations';
import { RawVisualizations } from '../factories/raw-visualizations';
import { VisHandlers } from '../factories/vis-handlers';
-import { AppState } from '../react-services';
+import { AppState, SavedObject } from '../react-services';
import { TabVisualizations } from '../factories/tab-visualizations';
import store from '../redux/store';
import { updateMetric } from '../redux/actions/visualizationsActions';
@@ -42,7 +42,6 @@ import {
getOverlays,
getPlugins,
} from '../kibana-services';
-import { KnownFields } from '../utils/known-fields';
import { union } from 'lodash';
import { getFilterWithAuthorizedAgents } from '../react-services/filter-authorization-agents';
import { AUTHORIZED_AGENTS } from '../../common/constants';
@@ -312,7 +311,7 @@ class KibanaVis extends Component {
this.tabVisualizations.addDeadVis();
return this.renderComplete();
}
- const match = error.message.match(/id:(.*)\)/);
+ const match = error.message.match(/id: (.*)\)/);
this.deadField = match[1] || true;
if (this.props.refreshKnownFields && !this.hasRefreshed) {
this.hasRefreshed = true;
@@ -322,11 +321,13 @@ class KibanaVis extends Component {
this.renderInProgress = false;
this.rendered = false;
- // if there's a field name it looks for known fields structures
- const foundField =
- match[1] && KnownFields.find((field) => field.name === match[1].trim());
-
- await this.props.refreshKnownFields(foundField);
+ const currentPattern = AppState.getCurrentPattern();
+ const pattern = await getDataPlugin().indexPatterns.get(currentPattern);
+ const fields = await SavedObject.getIndicesFields(pattern.title);
+ const foundField = fields.find(field => field.name === match[1]);
+ if(foundField){
+ await this.props.refreshKnownFields();
+ };
}
this.renderInProgress = false;
return this.myRender(raw); |
I noticed that the index pattern includes fields related to So, I guess if we add the fields used by the visualizations in the affected modules, Office365 and GitHub, to the template used by Wazuh and this is set to Elasticsearch, the new indices will contain their fields in the mapping, and the endpoint |
@asteriscos and I were discussing this issue and researching the options to solve. Current behaviorThe visualizations in the DesirableOur intention was that each visualization with the error of a missing field, report the field to the parent component to centralize the logic to update the fields of index pattern taking in account all the fields that are missing. We discussed how this could be done and managed some options to centralize the missing fields in the ProposalWe were discussing this with @gdiazlo and we agree to update the template used by Filebeat and the know fields that use the plugin to create the index pattern of alerts when there are no related indices. This is a partial solution that could avoid the toast appearing each time due to Kibana getting the fields of index patterns. Related to #3918 (comment). We should check:
|
ResearchThe plugin platform exposes methods to get the index pattern. The object of the index pattern has methods to manage the fields. They could help to add/modify the existing known fields by Kibana and avoid some errors related to unknown fields, in visualizations or fields displayed in the table of Modules Events` tab. // Add a field to the index pattern
indexPattern.fields.add(fieldSpec);
// example of fieldSpec
/*
const fieldSpec = {
name: "@sampledata",
type: "boolean",
esTypes: [
"boolean"
],
searchable: true,
aggregatable: true,
readFromDocValues: true
},
*/ another methods of In the case of Kibana 7.10.2, the button to refresh the fields of index pattern uses exposed methods of data plugin ( |
@asteriscos did a PR to update the template with the missing fields of the visualizations: wazuh/wazuh#12932 Using the new templateWhen the user updates the template, the new indices will have the new fields in the index mapping, not apply to the older ones. The user could reindex the older indices to take the new index settings: mappings and quey default fields, but it is not required. This causes that when the plugin gets the fields of the index pattern, they will be the fields defined in the mappings of the indices plus the fields extracted from the indexed documents. It is required that at least one index of the index pattern contains the new fields in its mappings, so when the fields of the index pattern are updated, the toast message should not appear due to a missing field in the index pattern that is used in some visualization of some dashboard. |
Related issue #4091 |
Description
When accessing some dashboards of modules, a toast appears saying the index pattern fields were refreshed and it is required to reload the page. After reloading the page, the toast appears again.
Steps to reproduce
Modules/Google Cloud Platform/Dashboard
Reload page
button or refreshing the page with the browser button or shortcut.Expected Result
Screenshots
Additional context
Add any other context about the problem here. Here you can paste log entries too or any other useful information that may help with the issue.
The text was updated successfully, but these errors were encountered: