[Osquery] Enable Results Export feature flag#275597
Conversation
|
/ci |
1 similar comment
|
/ci |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
The flag flip and OpenAPI publication look correct and consistent with the route gating (context.experimentalFeatures.exportResults) and the prior GA pattern. One documentation consistency issue on the x-state of the two newly-published export operations is noted inline.
Generated by Claude Reviewer for issue #275597 · 149.8 AIC · ⌖ 10.3 AIC · ⊞ 3.9K
tomsonpl
added
backport:skip
…sults/scheduled_results.schema.yaml Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
/ci |
|
Pinging @elastic/security-defend-workflows (Team:Defend Workflows) |
tomsonpl
changed the title
There was a problem hiding this comment.
Flag flip and OpenAPI publication look correct. One follow-up: the regenerated bundles are out of sync with the corrected scheduled_results source x-state — noted inline. The prior comment on the live-query export x-state still applies on the unchanged source line.
Generated by Claude Reviewer for issue #275597 · 149 AIC · ⌖ 12.2 AIC · ⊞ 3.9K
| summary: Export scheduled query results | ||
| tags: | ||
| - Security Osquery API | ||
| x-state: Added in 9.5.0 |
There was a problem hiding this comment.
The committed bundle is stale relative to its source schema. The scheduled_results source (common/api/scheduled_results/scheduled_results.schema.yaml) was corrected to x-state: Generally available; Added in 9.5.0, but this generated bundle — and the serverless bundle at the same line — still emit Added in 9.5.0 here, dropping the Generally available; prefix.
These docs/openapi/{ess,serverless}/*.bundled.schema.yaml files are generated from the source schemas via yarn openapi:bundle, so they should be regenerated after the source fix; otherwise the published scheduled-export endpoint renders without the GA indicator (inconsistent with the GA goal and with the sibling scheduled_results GET above, which uses Generally available; Added in 9.4.0).
Re-run yarn openapi:bundle in x-pack/platform/plugins/shared/osquery to refresh both bundles.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (6)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughThe 🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@elastic/ski-docs can I get a review on this one please? :) Thank you! |
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
There was a problem hiding this comment.
The flag flip and OpenAPI publication look correct and consistent with the route gating. One leftover consistency issue: the latest commit corrected the live-query export x-state in the source schema, but the generated bundles (and top-level oas docs) weren't regenerated, so that endpoint still publishes without the Generally available; prefix while its scheduled-export sibling has it. Noted inline with a regeneration reminder — non-blocking.
Generated by Claude Reviewer for issue #275597 · 175.5 AIC · ⌖ 7.41 AIC · ⊞ 3.9K
| summary: Export live query results | ||
| tags: | ||
| - Security Osquery API | ||
| x-state: Added in 9.5.0 |
There was a problem hiding this comment.
This bundle is stale relative to its source. The latest commit fixed the live-query export x-state in common/api/live_query/live_queries.schema.yaml to Generally available; Added in 9.5.0, but this regenerated bundle wasn't refreshed, so the live-query export endpoint still publishes without the GA prefix — inconsistent with the GA goal and with the sibling OsqueryExportScheduledQueryResults operation below (line 1344), which correctly reads Generally available; Added in 9.5.0.
The serverless bundle at the same line, and the top-level oas_docs/output/kibana.yaml / kibana.serverless.yaml, carry the same stale value. Re-run yarn openapi:bundle in x-pack/platform/plugins/shared/osquery (and let CI regenerate the top-level bundles) so all generated outputs match the corrected source.
| x-state: Added in 9.5.0 | |
| x-state: Generally available; Added in 9.5.0 |
| summary: Export live query results | ||
| tags: | ||
| - Security Osquery API | ||
| x-state: Added in 9.5.0 |
There was a problem hiding this comment.
Same stale value as the ESS bundle: the live-query export x-state here still reads Added in 9.5.0, but the source schema was corrected to Generally available; Added in 9.5.0 in the latest commit. Regenerate via yarn openapi:bundle so this bundle matches the source and the sibling scheduled export operation.
| x-state: Added in 9.5.0 | |
| x-state: Generally available; Added in 9.5.0 |
💛 Build succeeded, but was flaky
Failed CI StepsTest Failures
Metrics [docs]
History
cc @tomsonpl |
4 participants
Summary
Closes the GA release checklist for Osquery Export Results (security-team#17916).
This PR does two things to take the Export Results feature to GA in 9.5:
exportResultsexperimental feature flag by default (false → true). This is what surfaces the "Export results" button in the query-results UI and registers the server-side streaming export endpoints. Matches the prior GA-enablement pattern from [Osquery] FF Enabled for Osquery 9.4 rework #262693._exportpath operations were already authored but deliberately label-gated off (x-labels: [ ]) behind the flag. Now that the feature is GA, theirx-labelsare enabled ([ ess, serverless ]) and the bundled osquery OpenAPI schemas are regenerated so the endpoints appear in the published API reference.Endpoints now documented
POST /api/osquery/live_queries/{id}/results/{actionId}/_exportPOST /api/osquery/scheduled_results/{scheduleId}/{executionCount}/_exportBoth support
ndjson,json, andcsvoutput formats and stream the result file as an attachment.Verification
Verified end-to-end in a local Kibana (flag enabled):
_metablock (action_id,execution_count, query text,exported_by,format,total_results) plus theresultsarray.Screenshots
Release note
Osquery query results can now be exported as CSV, JSON, or NDJSON files directly from the query-results page (GA in 9.5).