You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am not sure if this should be raised against Elastic Agent or the integration. Raising it here, but please move as necessary.
The Cisco Secure Endpoint integration (v2.24.2) collects event data via httpjson. The integration throws an error when it hits the last page, and this gets logged in the Elastic Agent error log with something similar to: error processing response: template: :1:17: executing "" at <.last_response.body.metadata.links.next>: map has no entry for key "next"
This fills up the Elastic Agent dashboard with agent errors, as it is raised every time the Secure Endpoint data is polled (every 2 minutes/default) and the noise makes it more difficult to find actual errors.
I believe that this is occurring because fail_on_template_error is set to true.
I'm not sure how this should be fixed, because AIUI fail_on_template_error: true is the recommended configuration for pagination, but raising an error should maybe be reconsidered?
I am not sure if this should be raised against Elastic Agent or the integration. Raising it here, but please move as necessary.
The Cisco Secure Endpoint integration (v2.24.2) collects event data via httpjson. The integration throws an error when it hits the last page, and this gets logged in the Elastic Agent error log with something similar to:
error processing response: template: :1:17: executing "" at <.last_response.body.metadata.links.next>: map has no entry for key "next"
This fills up the Elastic Agent dashboard with agent errors, as it is raised every time the Secure Endpoint data is polled (every 2 minutes/default) and the noise makes it more difficult to find actual errors.
I believe that this is occurring because
fail_on_template_error
is set totrue
.The fail condition prompting this is at
integrations/packages/cisco_secure_endpoint/data_stream/event/agent/stream/httpjson.yml.hbs at main · elastic/integrations (github.com) line 36-40
I'm not sure how this should be fixed, because AIUI fail_on_template_error: true is the recommended configuration for pagination, but raising an error should maybe be reconsidered?
For confirmed bugs, please report:
Cisco Secure Endpoint integration v2.24.2
Elastic Agent v1.18.0
Elastic 8.11.2
Agent running on Windows Server 2019 Standard
https://discuss.elastic.co/t/elastic-agent-shouldnt-log-httpjson-pagination-completion-as-an-error/353565
This should happen on any run of the Secure Endpoint integration
The text was updated successfully, but these errors were encountered: