Motivation
As part of cloud posture plugin, we are using logs-cloud_security_posture.scores index as regular index (aka not a data stream) to write the current cluster score every 5 minutes.
Due to the append-only nature of score indexes, I believe it is better to have the score index be a data stream.
In addition, the current index is missing ILM policy, to smoothly support ILM is better to have data stream and not regular index.
** Before implementing, please read the following comment.
Definition of done
[ ] Create score data stream via CSPM integration
[ ] Delete index creation from Kibana
[ ] Support ILM
[ ] Udpate Elasticsearch privileges for kibana_system user
Motivation As part of cloud posture plugin, we are using
logs-cloud_security_posture.scores
index as regular index (aka not a data stream) to write the current cluster score every 5 minutes. Due to the append-only nature of score indexes, I believe it is better to have the score index be a data stream. In addition, the current index is missing ILM policy, to smoothly support ILM is better to have data stream and not regular index.** Before implementing, please read the following comment.
Definition of done
kibana_system
userOut of scope
Related tasks/epics
Checklist
Please follow the following checklist in the beginning of your work, please comment with a suggested of high level solution. It should include:
Before closing this ticket