maxmustermann/kibana
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Changes log level from info to debug from user complaints about logs filling up (#116518)

Browse source 
## Summary

Changes detections log level from info to debug within the detection engine. Users have been complaining about their log files filling up in excessive size from when they have noisy rules or if they have a large amount of rules enabled.
This commit is contained in:
Frank Hassanabad 2021-10-29 11:40:08 -06:00 committed by GitHub
parent 7c73e227eb
commit 83fe1dd90a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 5 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_wrapper.ts
View file

@ -302,7 +302,7 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
?.kibana_siem_app_url,
});
logger.info(
logger.debug(
buildRuleMessage(`Found ${createdSignalsCount} signals for notification.`)
);
@ -353,8 +353,7 @@ export const createSecurityRuleTypeWrapper: CreateSecurityRuleTypeWrapper =
});
}
// adding this log line so we can get some information from cloud
logger.info(
logger.debug(
buildRuleMessage(
`[+] Finished indexing ${createdSignalsCount} ${
!isEmpty(tuples)

2
x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/ml.ts
View file

@ -104,7 +104,7 @@ export const mlExecutor = async ({
const anomalyCount = filteredAnomalyResults.hits.hits.length;
if (anomalyCount) {
logger.info(buildRuleMessage(`Found ${anomalyCount} signals from ML anomalies.`));
logger.debug(buildRuleMessage(`Found ${anomalyCount} signals from ML anomalies.`));
}
const { success, errors, bulkCreateDuration, createdItemsCount, createdItems } =
await bulkCreateMlSignals({

5
x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
View file

@ -426,7 +426,7 @@ export const signalRulesAlertType = ({
?.kibana_siem_app_url,
});
logger.info(
logger.debug(
buildRuleMessage(`Found ${result.createdSignalsCount} signals for notification.`)
);
@ -478,8 +478,7 @@ export const signalRulesAlertType = ({
});
}
// adding this log line so we can get some information from cloud
logger.info(
logger.debug(
buildRuleMessage(
`[+] Finished indexing ${result.createdSignalsCount} ${
!isEmpty(tuples)