Skip to content

[Entity Store] Remove duplicate extraction error log to reduce alert noise#272047

Open
orouz wants to merge 1 commit into
elastic:mainfrom
orouz:rm_err_lg
Open

[Entity Store] Remove duplicate extraction error log to reduce alert noise#272047
orouz wants to merge 1 commit into
elastic:mainfrom
orouz:rm_err_lg

Conversation

@orouz
Copy link
Copy Markdown
Contributor

@orouz orouz commented May 31, 2026

our alerting rule ends up counting the same error twice:

  1. Logs extraction failed for host: Request timed out, took 30791ms
  2. Request timed out - this was removed in the PR

the rule fires if the count is >= 3, and we had a bunch of messages with a count of 4 errors, after this PR, these shouldn't be sent anymore.

note: didn't add an error log in the force_log_extraction consumer as it's for dev only anyway.

@orouz orouz added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Entity Store (Next) Team:Core Analysis Security Solution labels May 31, 2026
}

private async handleError(error: any, type: EntityType): Promise<ExtractedLogsSummary> {
this.logger.error(error);
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this func already persist (SO) and returns an error, so it makes sense the consumer would decide what do with it. in runTask we do log it.

@kibanamachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

@orouz orouz marked this pull request as ready for review May 31, 2026 15:57
@orouz orouz requested a review from a team as a code owner May 31, 2026 15:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting Entity Store (Next) release_note:skip Skip the PR/issue when compiling release notes Team:Core Analysis Security Solution

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants