Browse Source

(logger) change from error to warn for short circuiting user (#112895) (#113135)

👋🏽 howdy, team! 

I believe
[this](https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/NativeUsersStore.java#L233)
"error" by itself usually self-resolves and does not necessarily
guarantee any remediation is required. I would like to request shifting
the `logger` from `error` over to `warn` to reflect this.

```java
logger.error("security index is unavailable. short circuiting retrieval of user [{}]", user);
```

Introduced [here](https://github.com/elastic/elasticsearch/pull/34568).
Sample confirming when action is necessary, per [example
Discuss](https://discuss.elastic.co/t/security-index-is-unavailable/314824)
a sister log would induce an error message with problem called out. 

(Social note: For 24h analysis of ESS ES Cluster Logs, this was the 10th
top "error" at 5% of error volume. I'd like to remove noise where errors
aren't actionable so we can better monitor error trends.) 

🙏 TIA!

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Stef Nestor 1 year ago
parent
commit
1ceec4b638

+ 5 - 0
docs/changelog/112895.yaml

@@ -0,0 +1,5 @@
+pr: 112895
+summary: (logger) change from error to warn for short circuiting user
+area: Security
+type: enhancement
+issues: []

+ 1 - 1
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/NativeUsersStore.java

@@ -230,7 +230,7 @@ public class NativeUsersStore {
             if (frozenSecurityIndex.indexExists() == false) {
                 logger.trace("could not retrieve user [{}] because security index does not exist", user);
             } else {
-                logger.error("security index is unavailable. short circuiting retrieval of user [{}]", user);
+                logger.warn("could not retrieve user [{}] because security index is not available", user);
             }
             listener.onResponse(null);
         } else {