[Fleet] catching only mapper errors

x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.test.ts

@@ -12,6 +12,8 @@ import { safeLoad } from 'js-yaml';
 import { loggerMock } from '@kbn/logging-mocks';
 import { elasticsearchServiceMock } from '@kbn/core/server/mocks';
 
+import { errors } from '@elastic/elasticsearch';
+
 import { createAppContextStartContractMock } from '../../../../mocks';
 import { appContextService } from '../../..';
 import type { RegistryDataStream } from '../../../../types';
@@ -1261,5 +1263,65 @@ describe('EPM template', () => {
         },
       });
     });
+    it('should rollover on expected error', async () => {
+      const esClient = elasticsearchServiceMock.createElasticsearchClient();
+      esClient.indices.getDataStream.mockResponse({
+        data_streams: [{ name: 'test.prefix1-default' }],
+      } as any);
+      esClient.indices.simulateTemplate.mockImplementation(() => {
+        throw new errors.ResponseError({
+          statusCode: 400,
+          body: {
+            error: {
+              type: 'illegal_argument_exception',
+            },
+          },
+        } as any);
+      });
+      const logger = loggerMock.create();
+      await updateCurrentWriteIndices(esClient, logger, [
+        {
+          templateName: 'test',
+          indexTemplate: {
+            index_patterns: ['test.*-*'],
+            template: {
+              settings: { index: {} },
+              mappings: { properties: {} },
+            },
+          } as any,
+        },
+      ]);
+
+      expect(esClient.indices.rollover).toHaveBeenCalled();
+    });
+    it('should not rollover on unexpected error', async () => {
+      const esClient = elasticsearchServiceMock.createElasticsearchClient();
+      esClient.indices.getDataStream.mockResponse({
+        data_streams: [{ name: 'test.prefix1-default' }],
+      } as any);
+      esClient.indices.simulateTemplate.mockImplementation(() => {
+        throw new Error();
+      });
+      const logger = loggerMock.create();
+      try {
+        await updateCurrentWriteIndices(esClient, logger, [
+          {
+            templateName: 'test',
+            indexTemplate: {
+              index_patterns: ['test.*-*'],
+              template: {
+                settings: { index: {} },
+                mappings: { properties: {} },
+              },
+            } as any,
+          },
+        ]);
+        fail('expected updateCurrentWriteIndices to throw error');
+      } catch (err) {
+        // noop
+      }
+
+      expect(esClient.indices.rollover).not.toHaveBeenCalled();
+    });
   });
 });

x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.ts

@@ -11,6 +11,8 @@ import type {
   MappingTypeMapping,
 } from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 
+import { isResponseError } from '@kbn/es-errors';
+
 import type { Field, Fields } from '../../fields/field';
 import type {
   RegistryDataStream,
@@ -795,10 +797,18 @@ const updateExistingDataStream = async ({
 
     // if update fails, rollover data stream and bail out
   } catch (err) {
-    logger.info(`Mappings update for ${dataStreamName} failed due to ${err}`);
-    logger.info(`Triggering a rollover for ${dataStreamName}`);
-    await rolloverDataStream(dataStreamName, esClient);
-    return;
+    if (
+      isResponseError(err) &&
+      err.statusCode === 400 &&
+      err.body?.error?.type === 'illegal_argument_exception'
+    ) {
+      logger.info(`Mappings update for ${dataStreamName} failed due to ${err}`);
+      logger.info(`Triggering a rollover for ${dataStreamName}`);
+      await rolloverDataStream(dataStreamName, esClient);
+      return;
+    }
+    logger.error(`Mappings update for ${dataStreamName} failed due to unexpected error: ${err}`);
+    throw err;
   }
 
   // Trigger a rollover if the index mode or source type has changed