-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cisco: Add warning about script compilations to docs #14789
Conversation
Pinging @elastic/siem (Team:SIEM) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
@dedemorton do you want to take a look?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added a couple of suggestions, but overall looks great.
filebeat/docs/modules/cisco.asciidoc
Outdated
on your cluster: | ||
|
||
- {ref}/circuit-breaker.html#script-compilation-circuit-breaker[script.max_compilations_rate]: | ||
Increase the default value of `75/5m` to at least `100/5m`. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Might be best to avoid mentioning the default here because defaults change over time, and this info is likely to get stale.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just to clarify... I mean that the ES docs should be the source of truth for ES defaults. We probably shouldn't mention them in the Beats docs if we can avoid it.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
makes complete sense, thanks
filebeat/docs/modules/cisco.asciidoc
Outdated
Increase the default value of `75/5m` to at least `100/5m`. | ||
|
||
- {ref}/modules-scripting-using.html#modules-scripting-using-caching[script.cache_max_size]: | ||
Increase the default value of `100` to at least `200` if using both filesets |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
same comment about defaults
The cisco/asa and cisco/ftd filesets can cause problems with the default script compilation settings in Elasticsearch. This PR adds a warning about it to the docs and some workarounds. (cherry picked from commit 629b2eb)
The cisco/asa and cisco/ftd filesets can cause problems with the default script compilation settings in Elasticsearch. This PR adds a warning about it to the docs and some workarounds. (cherry picked from commit 629b2eb)
The cisco/asa and cisco/ftd filesets can cause problems with the default script compilation settings in Elasticsearch. This PR adds a warning about it to the docs and some workarounds.