-
Notifications
You must be signed in to change notification settings - Fork 129
Description
Getting following error when trying to run system benchmark on the sentinel_one.alert data stream:
Error: error running package system benchmarks: could not set up benchmark runner: could not create package policy (req {"name":"","description":"","namespace":"ep","policy_id":"b5af75ff-d0e8-4d50-b73e-83856a5a87ed","package":{"name":"sentinel_one","version":"1.37.0"},"inputs":{"sentinel_one-httpjson":{"enabled":true,"vars":{"api_token":"xxxx","enable_request_tracer":true,"url":"http://svc-sentinel_one:8080/"},"streams":{"sentinel_one.alert":{"enabled":true,"vars":{"preserve_original_event":true}}}}},"force":true}); API status code = 400; response body = {"statusCode":400,"error":"Bad Request","message":"Package policy is invalid: inputs.cel.vars.url: URL is required\ninputs.cel.vars.api_token: API Token is required"}
Command: elastic-package benchmark system --benchmark alert-benchmark -v.
I believe that the issue arises when the package has more than one inputs in the policy_templates and both the inputs have some required variables.
Scenario Definition:
---
description: Benchmark 100000 alert events ingested
input: httpjson
vars:
url: "http://svc-sentinel_one:8080/"
api_token: xxxx
enable_request_tracer: true
data_stream:
name: alert
vars:
preserve_original_event: true
warmup_time_period: 2s
corpora:
input_service:
name: sentinel_one
generator:
total_events: 100000
template:
path: ./alert-benchmark/template.ndjson
type: gotext
config:
path: ./alert-benchmark/config.yml
fields:
path: ./alert-benchmark/fields.yml