Packetbeat_dns_tunneling ML job Bug

Elastic Security
1

The packetbeat_dns_tunneling ML job still expects that the Packetbeat index template is applied. This is an issue when Elastic Agent is used.

image
image1525×711 171 KB

Issue was previously discussed here: Datafeed [datafeed-packetbeat_dns_tunneling] cannot retrieve data because no index matches datafeed's indices [packetbeat-*] - #14 by stephenb

2

Hi @warren.cruz

I don't see it in your screenshot, but can you confirm what version of the stack and agent that you're using to hit the problem?

Thanks,
-nf

3

Hi, Nick.

I'm using the Elastic Cloud, Version 8.16.6.

That error pops up when the ML job is started.

I managed to address the error by manually applying the Packetbeat index template.

Was wondering if this needs to be fixed so that Elastic Agent-driven integrations won't have to manually apply the Packetbeat index template.

Thanks.