Repository navigation
[Serverless security] [akamai] Failing test daily: policy test: test-default.yml in akamai.siem_otel #21334
Description
- Serverless: security
- Package: akamai
- Failing test: policy test: test-default.yml
- DataStream: siem_otel
- Owners:
- @elastic/security-service-integrations
- @elastic/sit-crest-contractors
Error:
unexpected content in policy: --- want
+++ got
@@ -4,4 +4,92 @@
elasticsearch/componentid-0:
+ bulk_response_filter_path: errors,items.*.error,items.*.status,items.*.failure_store
+ compression: gzip
+ compression_params:
+ level: 1
endpoints:
- https://elasticsearch:9200
+ include_source_on_error: true
+ logs_dynamic_id:
+ enabled: true
+ logs_dynamic_pipeline:
+ enabled: true
+ max_conns_per_host: 1
+ retry:
+ enabled: true
+ initial_interval: 1s
+ max_interval: 60s
+ max_retries: 3
+ retry_on_document_status:
+ - 429
+ - 500
+ - 501
+ - 502
+ - 503
+ - 504
+ - 505
+ - 506
+ - 507
+ - 508
+ - 510
+ - 511
+ retry_on_status:
+
First build failed: https://buildkite.com/elastic/integrations-serverless/builds/2075
Latest failed builds:
Activity
efd6 commentedon Sep 21, 2026
This and a bunch of other failures (9 packages/55 tests; predicted total of 26 packages/89 tests) appear to be due to elastic/kibana#288039.
muskan-agarwal26 commentedon Sep 28, 2026
The policy comparison fails because Fleet now writes default Elasticsearch exporter settings into the OTel policy. The .expected file only has endpoints. The downloaded policy also has compression, retry, logs_dynamic_pipeline, and the rest of that block.
This is the same diff on the security and observability serverless builds for akamai (test-default, test-no-cursor, test-preserve), claude_cowork, and claude_code.
It comes from elastic/kibana#288039, which is already merged. The older failures on these tests (for example #20076) were a different diff, component ids such as forward/componentid-0, and those were fixed by elastic-package v0.126.0 in #20512. These builds still fail on elastic-package v0.126.4.
The follow-up is elastic/elastic-package#3969, which is still an open issue and does not have a pull request yet. That change needs to ignore these known default fields so the same fixtures pass on stacks with #288039 and on older stacks that do not emit them.
Updating the .expected files in this package would fail policy tests on those older stacks. No package change for this issue.
muskan-agarwal26 commentedon Oct 14, 2026
elastic/elastic-package#4046 is merged and closes elastic/elastic-package#3969. It strips the Fleet Elasticsearch exporter defaults before the policy comparison, so the .expected files stay as they are.
Daily CI still uses elastic-package v0.126.4 (https://github.com/elastic/elastic-package/releases/tag/v0.126.4), which does not include that change. These issues can close once integrations bumps to a release that contains elastic-package#4046, the same way #20076 closed after #20512. No package change.
mrodm commentedon Oct 26, 2026
This failure was caused by the Elasticsearch exporter defaults that Fleet started injecting into the policy output on stack 9.5.5+, so the policy test saw extra fields that weren't in the expected file.
It was fixed in elastic-package by elastic/elastic-package#4046 ("Fix policy tests failing on 9.5.5+ due to Elasticsearch exporter output defaults injected by Fleet"). The fix shipped in v0.127.0.
Closing this as fixed. If the test fails again in the daily builds, a new issue will be created automatically.