Skip to content

Commit de545c7

Browse files
tonymeehantonymeehan
authored
Add CRE-2026 log-based rules for popular Kubernetes OSS projects (#167)
Co-authored-by: Tony Meehan <tonymeehan@users.noreply.github.com>
1 parent 0914195 commit de545c7

482 files changed

Lines changed: 8717 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎rules/cre-2026-0001/0001-elasticsearch-master-not-discovered-cluster-formation-failur.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
rules:
2+
- cre:
3+
id: CRE-2026-0001
4+
severity: 1
5+
title: "Elasticsearch master not discovered / cluster formation failure"
6+
category: kubernetes-problem
7+
author: Prequel (draft)
8+
description: |
9+
Draft rule for Elasticsearch/Kibana reliability issues (logs-first).
10+
cause: |
11+
See references.
12+
impact: |
13+
Reliability degradation or outage symptoms.
14+
impactScore: 6
15+
tags:
16+
- public
17+
- kubernetes
18+
mitigation: |
19+
Follow upstream guidance; validate in your environment.
20+
mitigationScore: 6
21+
references:
22+
- https://www.elastic.co/guide/en/elasticsearch/reference/current/discovery-troubleshooting.html
23+
applications:
24+
- name: elastic
25+
version: "*"
26+
metadata:
27+
kind: prequel
28+
id: FXwiLMB7hjrZHJjGSpDdW8
29+
gen: 1
30+
rule:
31+
set:
32+
event:
33+
source: cre.log.elasticsearch
34+
match:
35+
- value: "master not discovered yet"

‎rules/cre-2026-0001/test.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2026-01-01 00:00:00.000000+00:00 master not discovered yet

‎rules/cre-2026-0002/0002-elasticsearch-disk-watermark-triggered-flood-stage-read-only.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
rules:
2+
- cre:
3+
id: CRE-2026-0002
4+
severity: 1
5+
title: "Elasticsearch disk watermark triggered (flood-stage / read-only indices)"
6+
category: kubernetes-problem
7+
author: Prequel (draft)
8+
description: |
9+
Draft rule for Elasticsearch/Kibana reliability issues (logs-first).
10+
cause: |
11+
See references.
12+
impact: |
13+
Reliability degradation or outage symptoms.
14+
impactScore: 6
15+
tags:
16+
- public
17+
- kubernetes
18+
mitigation: |
19+
Follow upstream guidance; validate in your environment.
20+
mitigationScore: 6
21+
references:
22+
- https://www.elastic.co/guide/en/elasticsearch/reference/current/fix-watermark-errors.html
23+
applications:
24+
- name: elastic
25+
version: "*"
26+
metadata:
27+
kind: prequel
28+
id: f2aKPd2GJJayyy1PuCwhuo
29+
gen: 1
30+
rule:
31+
set:
32+
event:
33+
source: cre.log.elasticsearch
34+
match:
35+
- value: "flood stage disk watermark [95%] exceeded"

‎rules/cre-2026-0002/test.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2026-01-01 00:00:00.000000+00:00 flood stage disk watermark [95%] exceeded

‎rules/cre-2026-0003/0003-elasticsearch-circuit-breaker-exceptions-memory-pressure.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
rules:
2+
- cre:
3+
id: CRE-2026-0003
4+
severity: 1
5+
title: "Elasticsearch circuit breaker exceptions (memory pressure)"
6+
category: kubernetes-problem
7+
author: Prequel (draft)
8+
description: |
9+
Draft rule for Elasticsearch/Kibana reliability issues (logs-first).
10+
cause: |
11+
See references.
12+
impact: |
13+
Reliability degradation or outage symptoms.
14+
impactScore: 6
15+
tags:
16+
- public
17+
- kubernetes
18+
mitigation: |
19+
Follow upstream guidance; validate in your environment.
20+
mitigationScore: 6
21+
references:
22+
- https://www.elastic.co/guide/en/elasticsearch/reference/current/circuit-breaker.html
23+
applications:
24+
- name: elastic
25+
version: "*"
26+
metadata:
27+
kind: prequel
28+
id: EhpzTiganXBWNGAYV8WH2n
29+
gen: 1
30+
rule:
31+
set:
32+
event:
33+
source: cre.log.elasticsearch
34+
match:
35+
- value: "CircuitBreakingException: Data too large"

‎rules/cre-2026-0003/test.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2026-01-01 00:00:00.000000+00:00 CircuitBreakingException: Data too large

‎rules/cre-2026-0004/0004-elasticsearch-jvm-gc-overhead-stop-the-world-pressure.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
rules:
2+
- cre:
3+
id: CRE-2026-0004
4+
severity: 1
5+
title: "Elasticsearch JVM GC overhead / stop-the-world pressure"
6+
category: kubernetes-problem
7+
author: Prequel (draft)
8+
description: |
9+
Draft rule for Elasticsearch/Kibana reliability issues (logs-first).
10+
cause: |
11+
See references.
12+
impact: |
13+
Reliability degradation or outage symptoms.
14+
impactScore: 6
15+
tags:
16+
- public
17+
- kubernetes
18+
mitigation: |
19+
Follow upstream guidance; validate in your environment.
20+
mitigationScore: 6
21+
references:
22+
- https://www.elastic.co/guide/en/elasticsearch/reference/current/high-jvm-memory-pressure.html
23+
applications:
24+
- name: elastic
25+
version: "*"
26+
metadata:
27+
kind: prequel
28+
id: 5LxjgSuYertf6AqPrB7rEo
29+
gen: 1
30+
rule:
31+
set:
32+
event:
33+
source: cre.log.elasticsearch
34+
match:
35+
- value: "JvmGcMonitorService] [gc] overhead"

‎rules/cre-2026-0004/test.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2026-01-01 00:00:00.000000+00:00 JvmGcMonitorService] [gc] overhead

‎rules/cre-2026-0005/0005-elasticsearch-shard-allocation-failures-unassigned-shards.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
rules:
2+
- cre:
3+
id: CRE-2026-0005
4+
severity: 1
5+
title: "Elasticsearch shard allocation failures / unassigned shards"
6+
category: kubernetes-problem
7+
author: Prequel (draft)
8+
description: |
9+
Draft rule for Elasticsearch/Kibana reliability issues (logs-first).
10+
cause: |
11+
See references.
12+
impact: |
13+
Reliability degradation or outage symptoms.
14+
impactScore: 6
15+
tags:
16+
- public
17+
- kubernetes
18+
mitigation: |
19+
Follow upstream guidance; validate in your environment.
20+
mitigationScore: 6
21+
references:
22+
- https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-allocation-explain.html
23+
applications:
24+
- name: elastic
25+
version: "*"
26+
metadata:
27+
kind: prequel
28+
id: 35AcquPYNCwxfSGkR9Wq5E
29+
gen: 1
30+
rule:
31+
set:
32+
event:
33+
source: cre.log.elasticsearch
34+
match:
35+
- value: "unassigned shards"

‎rules/cre-2026-0005/test.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2026-01-01 00:00:00.000000+00:00 unassigned shards

0 commit comments

Comments
 (0)