Skip to content

[Cloud Security Posture] Transform fails to create destination index logs-cloud_security_posture.findings_latest-default #247430

@msplmee

Description

@msplmee

Kibana version: 8.17.3

Elasticsearch version: 8.17.3

Integration: Security Posture Management v1.12.0

Describe the bug:
I am encountering an issue with Cloud Security Posture (CSP) where the built-in transform fails to create its destination index and keeps retrying. As a result, CSP findings are not aggregated into the logs-cloud_security_posture.findings_latest-default index, which affects posture visibility and dashboards.

Screenshots (if relevant):
Image

Any additional context:
I suspect this issue is caused by an index template conflict:

  • The destination index name logs-cloud_security_posture.findings_latest-default matches the global logs index template.
  • That template enforces data_stream-only indices.
  • However, the CSP transform still attempts to create a regular index instead of a data stream.

Provide logs and/or server output (if relevant):

[Could not create destination index [logs-cloud_security_posture.findings_latest-default]
for transform [cloud_security_posture.findings_latest-default-8.15.0]];
Will automatically retry [8/-1]```

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugFixes for quality problems that affect the customer experienceneeds-teamIssues missing a team label

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions