Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Not able to create an EQL rule due to validation error #174427

Open
ghost opened this issue Jan 8, 2024 · 3 comments
Open
Labels
bug Fixes for quality problems that affect the customer experience Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@ghost
Copy link

ghost commented Jan 8, 2024

Kibana version:
7.17.16
Elasticsearch version:
7.17.16
Server OS version:
RHEL8
Browser version:

Browser OS version:

Original install method (e.g. download page, yum, from source, etc.):

Describe the bug:
Not able to create an EQL rule due to validation error

Steps to reproduce:

  1. Navigate to the rules page
  2. Click on create new rule
  3. Select Event Correlation type
  4. Enter a valid EQL query

Expected behavior:

Screenshots (if relevant):
image

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:
Full error

{ "name": "Error", "message": "{\"error\":{\"root_cause\":[{\"type\":\"illegal_argument_exception\",\"reason\":\"request [/nswl-*,ns-business-*,windows-infra-dns-*,windows-logs-*/_eql/search] contains unrecognized parameter: [max_concurrent_shard_requests]\"}],\"type\":\"illegal_argument_exception\",\"reason\":\"request [/nswl-*,ns-business-*,windows-infra-dns-*,windows-logs-*/_eql/search] contains unrecognized parameter: [max_concurrent_shard_requests]\"},\"status\":400}", "stack": "Error: {\"error\":{\"root_cause\":[{\"type\":\"illegal_argument_exception\",\"reason\":\"request [/nswl-*,ns-business-*,windows-infra-dns-*,windows-logs-*/_eql/search] contains unrecognized parameter: [max_concurrent_shard_requests]\"}],\"type\":\"illegal_argument_exception\",\"reason\":\"request [/nswl-*,ns-business-*,windows-infra-dns-*,windows-logs-*/_eql/search] contains unrecognized parameter: [max_concurrent_shard_requests]\"},\"status\":400}\n at u (https://itsec-kibana.hq.bc:5601/47441/bundles/plugin/securitySolution/8.0.0/securitySolution.chunk.12.js:3:19795)\n at async f (https://itsec-kibana.hq.bc:5601/47441/bundles/plugin/securitySolution/8.0.0/securitySolution.chunk.12.js:3:20356)" }

@ghost ghost added the bug Fixes for quality problems that affect the customer experience label Jan 8, 2024
@botelastic botelastic bot added the needs-team Issues missing a team label label Jan 8, 2024
@ghost
Copy link
Author

ghost commented Jan 8, 2024

Resolved this issue by set "0" in "max_concurrent_shard_requests" parameter in kibana Advanced Settings in Kibana Web UI.
It's correct, that this parameter affects EQL searches in Security Solution? As i understand, max_concurrent_shard_requests is not applicable for EQL searches, only for regular searches.

@dej611 dej611 added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Jan 8, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@botelastic botelastic bot removed the needs-team Issues missing a team label label Jan 8, 2024
@stefnestor
Copy link
Contributor

AFAICT appears to be duplicate of #165090 .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Development

No branches or pull requests

3 participants