Skip to content

[qualys_gav] Set lookup index mode on latest asset transform for ES|QL LOOKUP JOIN#20080

Merged
ShourieG merged 3 commits into
elastic:mainfrom
clement-fouque:qualys_gav-lookup-index-mode
Jul 10, 2026
Merged

[qualys_gav] Set lookup index mode on latest asset transform for ES|QL LOOKUP JOIN#20080
ShourieG merged 3 commits into
elastic:mainfrom
clement-fouque:qualys_gav-lookup-index-mode

Conversation

@clement-fouque

@clement-fouque clement-fouque commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

Configure the latest-asset transform destination with lookup index mode so it can be used as the right-hand side of ES|QL LOOKUP JOIN.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@clement-fouque
Update Qualys GAV integration to version 0.9.0 with enhancements for …
e9f364f 
…query-time asset enrichment using LOOKUP JOIN. Updated manifest and changelog, and added documentation for new features. Elasticsearch 9.1+ is required for the new lookup index mode.
@clement-fouque
Regenerate sample_event.json from tests
f51d932
@github-actions

github-actions Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.
File Line Rule Message
packages/qualys_gav/changelog.yml 4 Elastic.DirectionalLanguage Don't use directional language. Use 'the label of the element' instead of 'right-hand side'.

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@clement-fouque clement-fouque marked this pull request as ready for review July 10, 2026 09:42
@clement-fouque clement-fouque requested review from a team as code owners July 10, 2026 09:42
@clement-fouque clement-fouque mentioned this pull request Jul 10, 2026
Closed
@github-actions

This comment has been minimized.

Sign in to view
@github-actions

github-actions Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

TL;DR

The qualys_gav check fails because the checked-in rendered README is out of date. PR #20080 changes the README template and the asset sample event, but packages/qualys_gav/docs/README.md was not regenerated.

Remediation

  • From packages/qualys_gav, run elastic-package build and commit the regenerated docs/README.md.
  • Re-run the qualys_gav package check; it should no longer report checking readme files are up-to-date failed.
Investigation details

Root Cause

packages/qualys_gav/_dev/build/docs/README.md adds the Query-time asset enrichment (LOOKUP JOIN) section after setup, but the rendered packages/qualys_gav/docs/README.md still jumps directly from setup to Logs reference. The PR also updates the asset sample data; the generated README is expected to reflect those changes, while the checked-in rendered README retains the previous volume/whois array shapes and IPv4-mapped IPv6 value.

Evidence

  • Build: https://buildkite.com/elastic/integrations/builds/45859
  • Job/step: Check integrations qualys_gav
  • Key log excerpt: Error: checking package failed: checking readme files are up-to-date failed: files do not match
  • The CI diff shows generated README differences for volume, whois, and the ::ffff:5102:458e address.

Verification

Not run locally; the diagnosis is based on the failed package-check log and the PR contents.

Follow-up

The Vale directional-language warning in packages/qualys_gav/changelog.yml is separate and is not the cause of this Buildkite failure.

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Jul 10, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History

@mergify

mergify Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@ShourieG ShourieG merged commit 34e3054 into elastic:main Jul 10, 2026
11 checks passed
@andrewkroh andrewkroh added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:qualys_gav Qualys Global AssetView labels Jul 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ShourieG ShourieG ShourieG approved these changes

Assignees

No one assigned

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:qualys_gav Qualys Global AssetView

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@clement-fouque @ShourieG @andrewkroh