elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.81k stars 8.2k forks source link

[Security GenAI] Assistant Anonymization settings shows duplicate available fields when new Kibana Spaces are created #189138

Open peluja1012 opened 3 months ago

peluja1012 commented 3 months ago

Describe the bug: When new Kibana Spaces are created consecutively, the AI Assistant Anonymization settings tab displays duplicate available anonymization fields.

Kibana/Elasticsearch Stack version: v 8.15.0 BC3

Steps to reproduce:

  1. Create 2-3 spaces consecutively and quickly by navigating to Stack Management -> Spaces -> Create Space
  2. Navigate each individual space. Go to Stack Management -> AI Assistants -> Elastic AI Assistant for Security. Then go to the Anonymization settings tab.
  3. Notice that in some of the spaces, the Anonymization settings tab displays duplicated fields (i.e. host.name appears twice).
Screenshot 2024-07-24 at 2 48 28 PM
elasticmachine commented 3 months ago

Pinging @elastic/security-solution (Team: SecuritySolution)

angorayc commented 2 months ago

Test env: https://p.elstc.co/paste/TTt5LqFd#snUhCFJSfCU-cHM+srgWhfaZRIrpMpcH6HBAk6AVFPa

The fields duplicated after a new space created and landing on a Security Solution's page. (It fetched 200 fields When landing in the anonymization settings tab without further interaction. I used Devtools to check the count of the index, it did have 200 fields in it.) Therefore, I'm looking into the code where the index is initialised and written.

Current spaces with duplicated fields:

duplicatedFieldsBySpace

Space s2 with duplicated fields:

s2

Space s2 with No duplicated fields:

s1
angorayc commented 2 months ago
s28
angorayc commented 2 months ago

I was able to reproduce this sometimes after a new space created in https://new-bc3.kb.us-west2.gcp.elastic-cloud.com/ and landing on http://localhost:5601/s/{spaceId}/app/security/get_started.

It is not necessary to land on the AI settings page to have the fields created twice, so it is very likely that there is something unexpected happened when initialising anonymization fields after a new space get created.