Skip to content

[9.3](backport #48734) fix(filebeat/cel): avoid counting degraded runs as success#48894

Merged
andrewkroh merged 1 commit into9.3from
mergify/bp/9.3/pr-48734
Feb 17, 2026
Merged

[9.3](backport #48734) fix(filebeat/cel): avoid counting degraded runs as success#48894
andrewkroh merged 1 commit into9.3from
mergify/bp/9.3/pr-48734

Conversation

@mergify
Copy link
Contributor

@mergify mergify bot commented Feb 17, 2026

Proposed commit message

The `input.cel.periodic.program.run.success` OTel metric was incorrectly
counting CEL program evaluation failures as successes, resulting in
artificially inflated success rates. This occurred because success was
recorded when event publication succeeded, ignoring the `isDegraded` flag
that tracks actual evaluation failures.

This change ensures program success is recorded only when publication
succeeds and no degraded execution occurred, and adds a regression test
covering error-event runs via the OTel exporter.

Fixes #48714

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
  • I have added an entry in ./changelog/fragments using the changelog tool.

Related issues


This is an automatic backport of pull request #48734 done by [Mergify](https://mergify.com).

The `input.cel.periodic.program.run.success` OTel metric was incorrectly
counting CEL program evaluation failures as successes, resulting in
artificially inflated success rates. This occurred because success was
recorded when event publication succeeded, ignoring the `isDegraded` flag
that tracks actual evaluation failures.

This change ensures program success is recorded only when publication
succeeds and no degraded execution occurred, and adds a regression test
covering error-event runs via the OTel exporter.

Fixes #48714

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
(cherry picked from commit b7ddc3d)
@mergify mergify bot requested a review from a team as a code owner February 17, 2026 18:18
@mergify mergify bot added the backport label Feb 17, 2026
@mergify mergify bot requested a review from a team as a code owner February 17, 2026 18:18
@mergify mergify bot requested review from leehinman and removed request for a team February 17, 2026 18:18
@mergify mergify bot requested a review from khushijain21 February 17, 2026 18:18
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Feb 17, 2026
@github-actions
Copy link
Contributor

🤖 GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

@github-actions github-actions bot added Filebeat Filebeat Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team bugfix Team:Security-Service Integrations Security Service Integrations Team labels Feb 17, 2026
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Feb 17, 2026
@elasticmachine
Copy link
Contributor

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@andrewkroh andrewkroh merged commit 97ae468 into 9.3 Feb 17, 2026
22 checks passed
@andrewkroh andrewkroh deleted the mergify/bp/9.3/pr-48734 branch February 17, 2026 18:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport bugfix Filebeat Filebeat Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team Team:Security-Service Integrations Security Service Integrations Team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants