[cloudflare_logpush] fix conflicts in feature branch by brijesh-elastic · Pull Request #19186 · elastic/integrations

brijesh-elastic · 2026-05-25T11:15:13Z

Proposed commit message

cloudflare_logpush: fix conflicts in feature branch

…ic#18874) * [microsoft_sqlserver] add new field buffer_cache_hit_ratio_pct * add new panel * update screenshot and pr link

* chore: [updatecli] [weekly] Update latest snapshot to 8.19.16-SNAPSHOT Made with ❤️️ by updatecli * chore: [updatecli] [daily] Update latest snapshot to 8.19.16-SNAPSHOT Made with ❤️️ by updatecli --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* [azure_billing] enable agentless deployment * add pr link

* [azure_ai_foundry] add agentless deployment * add pr link

* [azure_openai] add agentless deployment * add pr link

* [Elasticsearch] Add querylog log data stream and Kibana assets Adds the new querylog dataset with ingest pipeline, fields, tests, docs, and packaged Kibana dashboard/search/dataview assets so Elasticsearch query logs can be collected and explored from the integration. Co-authored-by: Cursor <cursoragent@cursor.com> * [Elasticsearch] Clarify querylog docs description Updates the querylog docs blurb to reference Elasticsearch query logs documentation and the minimum supported version explicitly. Co-authored-by: Cursor <cursoragent@cursor.com> * [Elasticsearch] Update query analytics dashboard migration metadata Keeps the exported query analytics dashboard aligned with the latest saved object metadata from Kibana for this PR branch. Co-authored-by: Cursor <cursoragent@cursor.com> * [Elasticsearch] Update querylog saved search migration metadata Refreshes the exported querylog saved search metadata to match the latest object state used by the dashboard assets. Co-authored-by: Cursor <cursoragent@cursor.com> * [Elasticsearch] Revert manual saved object migration versions Restores the exported dashboard and search typeMigrationVersion values to avoid invalid manual downgrades. Co-authored-by: Cursor <cursoragent@cursor.com> * [Elasticsearch] Remove unsupported saved object attributes Drops dashboard pinned panels and saved search hideTable fields to keep querylog Kibana assets installable on older Kibana schemas used in CI. Co-authored-by: Cursor <cursoragent@cursor.com> * [Elasticsearch] Lower querylog asset migration versions for CI compatibility Adjusts dashboard and saved search typeMigrationVersion values to match the Kibana schema level used by package CI install tests. Co-authored-by: Cursor <cursoragent@cursor.com> * [Elasticsearch] Remove unsupported dashboard sections and search tabs Drops section-based dashboard layout fields and tabbed saved search fields not recognized by the Kibana schema used in package install tests. Co-authored-by: Cursor <cursoragent@cursor.com> * [Elasticsearch] Align querylog pipeline fixture with event constants Updates querylog expected pipeline output to stop asserting event.kind and event.category, which are provided by the target data stream mappings. Co-authored-by: Cursor <cursoragent@cursor.com> * [Elasticsearch] Fix querylog pipeline test fixtures for CI Updates querylog pipeline test fixtures to treat task IDs as numeric keywords and removes the synthetic transport error case that was being interpreted as an unexpected pipeline failure. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(elasticsearch): make querylog system test ingest synthetic query logs Elasticsearch 8.5 test stack does not emit query activity log files by default. Append ECS JSON lines from generate-logs.sh so the logfile system test can find documents. Add numeric_keyword_fields for task IDs in the system test config to match keyword mappings. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>

) * fix(elasticsearch): escape ES|QL in querylog field docs for Markdown tables Pipe characters in descriptions broke the exported-fields Markdown table. Use HTML entity &elastic#124; for the separator so cells stay aligned while still rendering as ES|QL. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(elasticsearch): repair query analytics dashboard layout and search panel - Replace discover_session embeddable with saved search panel (fixes missing Discover session tab after package install). - Move remote-cluster section panels and controls to bottom grid rows after section metadata was removed for older Kibana compatibility. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>

…ard fixes (elastic#18926) bump packages/elasticsearch package version from 1.21.0 to 1.21.1

beyondtrust_pra: release package as GA

* Renaming crash event name * Updating OTel android content package's metadata * Using PR number

Add a troubleshooting section to the README explaining the "exceeding maximum number of CEL executions" error and how to resolve it by increasing the Maximum Pages Per Interval setting. The max_executions option was added in v1.5.0 but not documented. Updates elastic#18496

The Handlebars template stores the user's event filter config as state.event_filter, but the CEL program read state.events_filter (note the extra 's'). The optional field access returned none, so the "events" query parameter was never included in the API request, so event filtering was silently ignored. Additionally, format_query() on a list produces repeated keys (events=a&events=b). The Snyk API documents the parameter as a comma-separated list, so the fix joins the list into a single value (events=a,b). Snyk's OpenAPI spec names the parameter "event" (singular), but live testing confirms the API only honours "events" (plural) — "event" is silently ignored. The migration guide also documents the plural form: https://docs.snyk.io/snyk-api/api-end-of-life-eol-process-and-migration-guides/guides-to-migration/search-audit-logs-group-and-org-v1-api-to-ga-rest-audit-logs-api-migration-guide Tested against a live Snyk org endpoint with mito, confirming the filter now correctly narrows results.

* Add apm monitoring dashboard to package * Add changelog * Fix apm version placeholder * Update apm dashboard and ship data view * Update apm dashboard so that it works on >=9.1.0 * Update apm dashboard from review * Remove some unnecessary y-axis titles * Fix dashboard name * Fix data view pattern * Add note to TBS section * Fix title * Remove duplicate events active viz

…ic#18831) Change certificate.identity.allowed_resource_ids from keyword to flattened. Teleport's proto defines this as repeated ResourceID, an array of objects with cluster, kind, name, and sub_resource fields. The keyword mapping rejected these with document_parsing_exception. Add a field definition for teleport.audit.addr, which carries the target address in port forwarding events (event code T3003I). The pipeline already handled the dotted-key addr.local/addr.remote form from ConnectionMetadata but had no mapping for the plain string form from PortForward. Fix a copy-paste error in the setup documentation that referenced Symantec Endpoint Security instead of Teleport. Test events were constructed from the Teleport events proto definition (api/proto/teleport/legacy/types/events/events.proto), not captured from a live system.

…ch (elastic#18876)

…pport, and system tests (elastic#16732)

* [azure_functions] enable agentless deployment * add pr link

* Add description and artifacts to alerting rule

…lastic#18901) The services variable listed only 7 of the 18 service values the Directory Insights API accepts. Update the manifest description and add a supported-services table to the README so users can discover values like access_management, software, and password_manager without consulting JumpCloud's API docs. Relates elastic#18542

Replace settings.unattended: true with settings.num_failure_retries: -1 in all ti_* managed transforms. Unlike unattended mode which retries all failures indefinitely (masking irrecoverable errors), num_failure_retries: -1 retries only recoverable failures while still surfacing genuinely irrecoverable ones to users. Three packages (ti_anyrun, ti_flashpoint, ti_strider) that were added after the original unattended PR (elastic#16535) had no failure resilience at all and now get num_failure_retries: -1 added. [git-generate] for transform in $(find packages/ti_*/ -type f -name transform.yml \ -path '*/elasticsearch/transform/*'); do yq -i 'del(.settings.unattended)' "$transform" yq -i '.settings.num_failure_retries = -1' "$transform" done for transform in $(git diff --name-only packages/ | \ grep 'transform\.yml$'); do current=$(yq '._meta.fleet_transform_version' "$transform") next=$(echo "$current" | awk -F. '{printf "%d.%d.%d",$1,$2+1,0}') yq -i "._meta.fleet_transform_version = \"$next\"" "$transform" done for pkg in $(git diff --name-only packages/ | cut -d/ -f1,2 | \ sort -u); do cd "$pkg" elastic-package changelog add \ --description "Use num_failure_retries instead of unattended mode for transform failure recovery." \ --type enhancement --next minor \ --link "elastic#18404" cd ../../ done

Add Elastic APM Intake OpenTelemetry Input Package

…18942) Introduces a reusable pipeline step (`check-ci-python-scripts`) that runs unit tests for Python scripts used in CI, starting with `find_oldest_supported_version.py`. The step runs in an isolated venv and in parallel with the Go source check. The `test-integrations` step is gated on it passing. --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* [nginx_otel] move links from markdown to link panel * update pr link * bump version

…8949) Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.44.0 to 0.45.0. - [Release notes](https://github.com/golang/tools/releases) - [Commits](golang/tools@v0.44.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/tools dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ts (elastic#18956) Bumps [requests](https://github.com/psf/requests) from 2.32.3 to 2.33.0. - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.3...v2.33.0) --- updated-dependencies: - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…root paths (elastic#18641) The extract_file_name_from_path grok processor in the thor_forwarding ingest pipeline failed on two classes of path: - Windows paths with a lowercase drive letter (e.g. c:\...) because the pattern used [A-Z] instead of [A-Za-z]. - POSIX root-level paths (e.g. /file.txt) because the pattern required at least one character before the first slash (.+/). Widen the character class and adjust the POSIX pattern so both cases match. Add pipeline tests covering a lowercase-drive Windows path and a root-level POSIX path.

…lastic#18976) Expose max_executions as a configurable variable for the application data stream so operators can raise the execution budget for large estates where the two-level worklist traversal (inventory pages x endpoint pages) exceeds the default of 1000. Move the worklist, pagination tokens, and fetch_more flag into the cursor instead of the state root. The CEL input persists the cursor after each successful event publish, so an interrupted traversal resumes where it left off on the next interval rather than starting over from scratch. Closes elastic#18974

Lower the default batch_size for endpoint_activity and network_activity from 1000 to 200. The CEL input holds the entire API response in memory during processing, and at 1000 the peak allocation can push memory-constrained agents past their cgroup limit. The description now warns that values above 200 risk out-of-memory failures on such agents. Closes elastic#18975

…ic#18979) Made with ❤️️ by updatecli Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

elasticmachine · 2026-05-25T11:35:11Z

💔 Build Failed

Buildkite Build
Commit: 1d2ba93

Failed CI Steps

History

cc @brijesh-elastic

github-actions · 2026-05-25T11:43:27Z

TL;DR

Check integrations netbox failed, but the provided Buildkite log is truncated to teardown/artifact-upload output and does not contain the failing test/assertion. Immediate next step is to rerun the same job (or share the uploaded netbox-system-*.xml test result) so the actual root cause can be identified and fixed.

Remediation

Re-run the failing Buildkite step: Check integrations netbox from build https://buildkite.com/elastic/integrations/builds/43437.
From that rerun, capture and share either:
- the first failing test block from step output, or
- the uploaded JUnit file build/test-results/netbox-system-*.xml (this is where the concrete assertion/error should be).
Once the failing assertion is visible, apply a targeted fix and validate by re-running check integrations netbox for this PR head commit.

Investigation details

Root Cause

The root cause is currently inconclusive from available data. The pre-fetched log file only includes stack teardown and artifact upload, then exits with status 1, but does not include the underlying failing test output.

Evidence

Build: https://buildkite.com/elastic/integrations/builds/43437
Job/step: Check integrations netbox
Key log excerpt:
- --- [netbox] failed
- 🚨 Error: The command exited with status 1
- Artifact upload includes build/test-results/netbox-system-1779708893048433542.xml (2.4 KiB)
Provided log path: /tmp/gh-aw/buildkite-logs/integrations-check-integrations-netbox.txt (contains only teardown + artifact upload section, no failing assertion stack)

Verification

Not run locally in this workflow context (CI helper script requires Buildkite-specific environment variables such as YQ_VERSION, so it fails before reproducing the package failure).

Follow-up

If you share the failing assertion block (or the netbox-system-*.xml contents), I can provide a concrete code-level root-cause and exact patch recommendation.

Note

🔒 Integrity filter blocked 178 items

The following items were blocked because they don't meet the GitHub integrity level.

#19186 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
[cloudflare_logpush] fix conflicts in feature branch #19186 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19186 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19186 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19185 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19184 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19182 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19180 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19179 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19177 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19174 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19171 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19160 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19144 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19143 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
#19141 list_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
... and 162 more items

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

infra-vault-gh-plugin-prod · 2026-05-25T12:03:57Z

Pinging @elastic/integration-experience (Team:Integration-Experience)

infra-vault-gh-plugin-prod · 2026-05-25T12:03:58Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

infra-vault-gh-plugin-prod · 2026-05-25T12:03:58Z

Pinging @elastic/ecosystem (Team:Ecosystem)

elastic-vault-github-plugin-prod · 2026-05-25T14:52:53Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

jakubgalecki0 and others added 30 commits May 8, 2026 09:58

[microsoft_sqlserver] add new field buffer_cache_hit_ratio_pct (elast…

9a02a86

…ic#18874) * [microsoft_sqlserver] add new field buffer_cache_hit_ratio_pct * add new panel * update screenshot and pr link

[azure_billing] enable agentless deployment (elastic#18848)

b812167

* [azure_billing] enable agentless deployment * add pr link

[azure_ai_foundry] add agentless deployment (elastic#18824)

777b1b1

* [azure_ai_foundry] add agentless deployment * add pr link

[azure_openai] add agentless deployment (elastic#18825)

4edf61c

* [azure_openai] add agentless deployment * add pr link

chore(elasticsearch): bump package to 1.21.1 for querylog docs/dashbo…

9c1f07e

…ard fixes (elastic#18926) bump packages/elasticsearch package version from 1.21.0 to 1.21.1

[BeyondTrust PRA] Release BeyondTrust PRA as GA (elastic#18517)

66eb2ff

beyondtrust_pra: release package as GA

Rename app crash to device crash (elastic#18183)

c660b16

* Renaming crash event name * Updating OTel android content package's metadata * Using PR number

Avoid triggering all package tests on first commit of a backport bran…

7ed2346

…ch (elastic#18876)

[Redis] Add Redis INFO enhancements: new 6.x/7.x fields, subexpiry su…

9e43b20

…pport, and system tests (elastic#16732)

[azure_functions] enable agentless deployment (elastic#18851)

b7dcfe9

* [azure_functions] enable agentless deployment * add pr link

Adding apm-agent-approvers as Android codeowners (elastic#18933)

22fb884

Add description and artifacts to alerting rule (elastic#18506)

4139a0b

* Add description and artifacts to alerting rule

Add Elastic APM Intake OpenTelemetry Input Package (elastic#17114)

a224134

Add Elastic APM Intake OpenTelemetry Input Package

[nginx_otel] move links from markdown to link panel (elastic#18939)

be72950

* [nginx_otel] move links from markdown to link panel * update pr link * bump version

chore: update pkgs in .github/ISSUE_TEMPLATE/integration_*.yml (elast…

62023f8

…ic#18979) Made with ❤️️ by updatecli Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

kcreddy removed request for a team May 25, 2026 11:19

github-actions Bot mentioned this pull request May 25, 2026

[breaking-change] Undocumented breaking changes detected (2026-05-25) #19189

Open

3 tasks

This was referenced May 26, 2026

backport: automate backport PR creation from checklist and fix changelog links #19214

Open

[docs-patrol] Update Okta README for OIN authentication flow #19236

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[cloudflare_logpush] fix conflicts in feature branch#19186

[cloudflare_logpush] fix conflicts in feature branch#19186
brijesh-elastic wants to merge 106 commits into
elastic:feature/cloudflare_logpush-enhancementfrom
brijesh-elastic:cloudflare_log_fix_conflicts

brijesh-elastic commented May 25, 2026

Uh oh!

elasticmachine commented May 25, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 25, 2026

Root Cause

Evidence

Verification

Follow-up

Uh oh!

infra-vault-gh-plugin-prod Bot commented May 25, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented May 25, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented May 25, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

brijesh-elastic commented May 25, 2026

Proposed commit message

Uh oh!

elasticmachine commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

History

Uh oh!

github-actions Bot commented May 25, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

Follow-up

Uh oh!

infra-vault-gh-plugin-prod Bot commented May 25, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented May 25, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented May 25, 2026

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 25, 2026

🚀 Benchmarks report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

elasticmachine commented May 25, 2026 •

edited

Loading