[8.16] [Entity Analytics] API changes for right placement of deleting…

… the old component template (#199734) (#200591) # Backport This will backport the following commits from `main` to `8.16`: - [[Entity Analytics] API changes for right placement of deleting the old component template (#199734)](#199734)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)
elastic · Nov 18, 2024 · 0699913 · 0699913
1 parent e6faaa2
commit 0699913
Show file tree

Hide file tree

Showing 2 changed files with 106 additions and 22 deletions.
diff --git a/...lugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_data_client.ts b/...lugins/security_solution/server/lib/entity_analytics/risk_score/risk_score_data_client.ts
@@ -120,30 +120,10 @@ export class RiskScoreDataClient {
       const oldComponentTemplateExists = await esClient.cluster.existsComponentTemplate({
         name: mappingComponentName,
       });
-      // If present then copy the contents to a new component template with the namespace in the name
       if (oldComponentTemplateExists) {
-        const oldComponentTemplateResponse = await esClient.cluster.getComponentTemplate(
-          {
-            name: mappingComponentName,
-          },
-          { ignore: [404] }
-        );
-        const oldComponentTemplate = oldComponentTemplateResponse?.component_templates[0];
-        const newComponentTemplateName = nameSpaceAwareMappingsComponentName(namespace);
-        await esClient.cluster.putComponentTemplate({
-          name: newComponentTemplateName,
-          body: oldComponentTemplate.component_template,
-        });
+        await this.updateComponentTemplateNamewithNamespace(namespace);
       }
 
-      // Delete the component template without the namespace in the name
-      await esClient.cluster.deleteComponentTemplate(
-        {
-          name: mappingComponentName,
-        },
-        { ignore: [404] }
-      );
-
       // Update the new component template with the required data
       await Promise.all([
         createOrUpdateComponentTemplate({
@@ -188,6 +168,14 @@ export class RiskScoreDataClient {
         },
       });
 
+      // Delete the component template without the namespace in the name
+      await esClient.cluster.deleteComponentTemplate(
+        {
+          name: mappingComponentName,
+        },
+        { ignore: [404] }
+      );
+
       await createDataStream({
         logger: this.options.logger,
         esClient,
@@ -327,4 +315,20 @@ export class RiskScoreDataClient {
       { logger: this.options.logger }
     );
   }
+
+  private async updateComponentTemplateNamewithNamespace(namespace: string): Promise<void> {
+    const esClient = this.options.esClient;
+    const oldComponentTemplateResponse = await esClient.cluster.getComponentTemplate(
+      {
+        name: mappingComponentName,
+      },
+      { ignore: [404] }
+    );
+    const oldComponentTemplate = oldComponentTemplateResponse?.component_templates[0];
+    const newComponentTemplateName = nameSpaceAwareMappingsComponentName(namespace);
+    await esClient.cluster.putComponentTemplate({
+      name: newComponentTemplateName,
+      body: oldComponentTemplate.component_template,
+    });
+  }
 }
diff --git a/...t_suites/entity_analytics/risk_engine/trial_license_complete_tier/init_and_status_apis.ts b/...t_suites/entity_analytics/risk_engine/trial_license_complete_tier/init_and_status_apis.ts
@@ -540,7 +540,87 @@ export default ({ getService }: FtrProviderContext) => {
         );
       });
 
-      describe('remove legacy risk score transform', function () {
+      it('should update the existing component template and index template without any errors', async () => {
+        const componentTemplateName = '.risk-score-mappings';
+        const indexTemplateName = '.risk-score.risk-score-default-index-template';
+        const newComponentTemplateName = '.risk-score-mappings-default';
+
+        // Call API to put the component template and index template
+
+        await es.cluster.putComponentTemplate({
+          name: componentTemplateName,
+          body: {
+            template: {
+              settings: {
+                number_of_shards: 1,
+              },
+              mappings: {
+                properties: {
+                  timestamp: {
+                    type: 'date',
+                  },
+                  user: {
+                    properties: {
+                      id: {
+                        type: 'keyword',
+                      },
+                      name: {
+                        type: 'text',
+                      },
+                    },
+                  },
+                },
+              },
+            },
+            version: 1,
+          },
+        });
+
+        // Call an API to put the index template
+
+        await es.indices.putIndexTemplate({
+          name: indexTemplateName,
+          body: {
+            index_patterns: [indexTemplateName],
+            composed_of: [componentTemplateName],
+            template: {
+              settings: {
+                number_of_shards: 1,
+              },
+              mappings: {
+                properties: {
+                  timestamp: {
+                    type: 'date',
+                  },
+                  user: {
+                    properties: {
+                      id: {
+                        type: 'keyword',
+                      },
+                      name: {
+                        type: 'text',
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        });
+
+        const response = await riskEngineRoutes.init();
+        expect(response.status).to.eql(200);
+        expect(response.body.result.errors).to.eql([]);
+
+        const response2 = await es.cluster.getComponentTemplate({
+          name: newComponentTemplateName,
+        });
+        expect(response2.component_templates.length).to.eql(1);
+        expect(response2.component_templates[0].name).to.eql(newComponentTemplateName);
+      });
+
+      // Failing: See https://github.com/elastic/kibana/issues/191637
+      describe.skip('remove legacy risk score transform', function () {
         this.tags('skipFIPS');
         it('should remove legacy risk score transform if it exists', async () => {
           await installLegacyRiskScore({ supertest });