fix(filebeat/cel): avoid counting degraded runs as success#48734
Merged
andrewkroh merged 4 commits intoelastic:mainfrom Feb 17, 2026
Merged
fix(filebeat/cel): avoid counting degraded runs as success#48734andrewkroh merged 4 commits intoelastic:mainfrom
andrewkroh merged 4 commits intoelastic:mainfrom
Conversation
The `input.cel.periodic.program.run.success` OTel metric was incorrectly counting CEL program evaluation failures as successes, resulting in artificially inflated success rates. This occurred because success was recorded when event publication succeeded, ignoring the `isDegraded` flag that tracks actual evaluation failures. This change ensures program success is recorded only when publication succeeds and no degraded execution occurred, and adds a regression test covering error-event runs via the OTel exporter. Fixes elastic#48714
andrewkroh
added
Filebeat
botelastic
bot
added
needs_team
Contributor
🤖 GitHub commentsJust comment with:
|
Contributor
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
pierrehilbert
added
the
Team:Elastic-Agent-Data-Plane
Contributor
|
Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane) |
efd6
reviewed
Feb 8, 2026
Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
VihasMakwana
approved these changes
Feb 17, 2026
efd6
approved these changes
Feb 17, 2026
mergify bot
pushed a commit
that referenced
this pull request
Feb 17, 2026
The `input.cel.periodic.program.run.success` OTel metric was incorrectly counting CEL program evaluation failures as successes, resulting in artificially inflated success rates. This occurred because success was recorded when event publication succeeded, ignoring the `isDegraded` flag that tracks actual evaluation failures. This change ensures program success is recorded only when publication succeeds and no degraded execution occurred, and adds a regression test covering error-event runs via the OTel exporter. Fixes #48714 Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co> (cherry picked from commit b7ddc3d)
6 tasks
andrewkroh
added a commit
that referenced
this pull request
Feb 17, 2026
…48894) The `input.cel.periodic.program.run.success` OTel metric was incorrectly counting CEL program evaluation failures as successes, resulting in artificially inflated success rates. This occurred because success was recorded when event publication succeeded, ignoring the `isDegraded` flag that tracks actual evaluation failures. This change ensures program success is recorded only when publication succeeds and no degraded execution occurred, and adds a regression test covering error-event runs via the OTel exporter. Fixes #48714 (cherry picked from commit b7ddc3d) Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co> Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed commit message
Checklist
stresstest.shscript to run them under stress conditions and race detector to verify their stability../changelog/fragmentsusing the changelog tool.Related issues
input.cel.periodic.program.run.successmetric counts evaluation failures as successes #48714