Full disclosure: I detail this further in the official Elastic support portal under case #01610754.
Noticing an issue on a fresh stack version 8.12.1 install where the create fleet package policy API for the winlog integration fails.
Data stream backing index template "logs-winlog.winlog", an ingest pipeline, and component templates "logs-winlog.winlog@package" and "logs-winlog.winlog@custom" are not loaded with an apparent Kibana log message error which reads:
[2024-04-30T20:34:20.445+00:00][ERROR][plugins.fleet] Error: Stream template not found, unable to find dataset winlog.winlog
at _compilePackageStream (/usr/share/kibana/node_modules/@kbn/fleet-plugin/server/services/package_policy.js:1442:11)
at /usr/share/kibana/node_modules/@kbn/fleet-plugin/server/services/package_policy.js:1391:55
at Array.map (<anonymous>)
at _compilePackageStreams (/usr/share/kibana/node_modules/@kbn/fleet-plugin/server/services/package_policy.js:1391:41)
at /usr/share/kibana/node_modules/@kbn/fleet-plugin/server/services/package_policy.js:1356:35
at processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Promise.all (index 0)
Did a manual upload of winlog version 2.1.1 where you can see the .kibana_ingest document referenced by _id: epm-packages:winlog appears to be missing objects/refs typically listed in _source['epm-packages]['installed_es'].
Full disclosure: I detail this further in the official Elastic support portal under case #01610754.
Noticing an issue on a fresh stack version 8.12.1 install where the create fleet package policy API for the
winlog
integration fails.Data stream backing index template "logs-winlog.winlog", an ingest pipeline, and component templates "logs-winlog.winlog@package" and "logs-winlog.winlog@custom" are not loaded with an apparent Kibana log message error which reads:
Did a manual upload of
winlog
version2.1.1
where you can see the.kibana_ingest
document referenced by_id
:epm-packages:winlog
appears to be missing objects/refs typically listed in_source['epm-packages]['installed_es']
.Can anyone confirm whether or not they can replicate this issue regarding the PR in subject?
Originally posted by @zedtran in https://github.com/elastic/integrations/issues/8010#issuecomment-2087691580