Failing ES Promotion: FTR Configs #22 / detection engine api security and spaces enabled - rule execution logic Non ECS fields in alert document source should fail creating alert when ECS field mapping is geo_point

[mistic]

X-Pack Detection Engine API Integration Tests
x-pack/test/detection_engine_api_integration/security_and_spaces/rule_execution_logic/non_ecs_fields.ts

detection engine api security and spaces enabled - rule execution logic Non ECS fields in alert document source should fail creating alert when ECS field mapping is geo_point

This failure is preventing the promotion of the current Elasticsearch nightly snapshot.

For more information on the Elasticsearch snapshot promotion process including how to reproduce using the unverified nightly ES build: https://www.elastic.co/guide/en/kibana/master/development-es-snapshots.html

• Failed promotion job
• Test Failure

JestAssertionError: expect(received).toContain(expected) // indexOf

Expected value: "Bulk Indexing of signals failed: failed to parse field [client.geo.location] of type [geo_point]"
Received array: ["Bulk Indexing of signals failed: [1:1201] failed to parse field [client.geo.location] of type [geo_point]"]
    at Context.<anonymous> (non_ecs_fields.ts:273:22)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at Object.apply (wrap_function.js:73:16) {
  matcherResult: {
    message: '\x1B[2mexpect(\x1B[22m\x1B[31mreceived\x1B[39m\x1B[2m).\x1B[22mtoContain\x1B[2m(\x1B[22m\x1B[32mexpected\x1B[39m\x1B[2m) // indexOf\x1B[22m\n' +
      '\n' +
      'Expected value: \x1B[32m"Bulk Indexing of signals failed: failed to parse field [client.geo.location] of type [geo_point]"\x1B[39m\n' +
      'Received array: \x1B[31m["Bulk Indexing of signals failed: [1:1201] failed to parse field [client.geo.location] of type [geo_point]"]\x1B[39m',
    pass: false
  }
}

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[mistic]

Skipped.

main: 06f5a01

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[WafaaNasr]

Running through https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/2626#01894ed1-0606-4462-bf82-697455429fdd.

The first test fails because of

1. detection engine api security and spaces enabled - rule execution logic

Non ECS fields in alert document source
  should remove source array of keywords field from alert if ECS field mapping is nested:
 
  Error: expect(received).toHaveProperty(path, value)
  
  Expected path: "threat.indicator.port"
  Received path: "threat"
   
  Expected value: 443
  Received value: {"enrichments": [], "indicator.port": 443}
  at Context. (non_ecs_fields.ts:234:27)
  at runMicrotasks ()
  at processTicksAndRejections (node:internal/process/task_queues:96:5)
  at Object.apply (wrap_function.js:73:16)

 

[WafaaNasr]

PR used to skip the test #161846

[e40pud]

Un-skipped in 8.10.0