Skip to content

Commit 36a3b49

Browse files
authored
Add 'no integrations found' symptom to troubleshooting guide and FAQ entry
1 parent 9a4d23e commit 36a3b49

2 files changed

Lines changed: 3 additions & 2 deletions

File tree

solutions/security/get-started/automatic-migration-troubleshooting.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ The `.kibana-siem-rule-migrations-integrations` index contains a `semantic_text`
2222

2323
This causes the following symptoms:
2424

25+
- **No integrations found for translated rules** — after completing an automatic migration, the **Integrations** column on the Translated rules page shows no integrations even when they should exist, because integration matching relies on semantic search against this index.
2526
- **Inconsistent search results across machines or clusters** — the same query returns different documents because the query-time inference model doesn't match the index-time model on the other cluster.
2627
- **Semantic search returning no results or wrong results** — Jina produces dense vectors; ELSER produces sparse vectors; they are incompatible vector spaces.
2728
- **`function_score` queries with `min_score` returning zero hits** — scores computed against mismatched embeddings are meaningless and rarely cross any threshold.

solutions/security/get-started/automatic-migration.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,6 @@ Rule migration data appears in `.kibana-siem-rule-migrations-rules-default`. Das
271271

272272
Assets that fall into this category will typically appear with a status of partially translated. You can use the [`LOOKUP JOIN`](elasticsearch://reference/query-languages/esql/esql-lookup-join.md) capability to help in this situation.
273273

274-
**Why does semantic search return incorrect or inconsistent results after migration?**
274+
**Why does semantic search return incorrect or inconsistent results after migration, or why are no integrations shown for translated rules?**
275275

276-
This can occur if the `.kibana-siem-rule-migrations-integrations` index was created when the ELSER inference endpoint was unavailable, causing it to fall back to a different embedding model. Refer to [Troubleshoot Automatic Migration](automatic-migration-troubleshooting.md) for instructions on how to re-create the index with the correct ELSER inference endpoint.
276+
This can occur if the `.kibana-siem-rule-migrations-integrations` index was created when the ELSER inference endpoint was unavailable, causing it to fall back to a different embedding model. This mismatched model causes integration matching to fail, resulting in no integrations appearing for translated rules, as well as inconsistent or empty semantic search results. Refer to [Troubleshoot Automatic Migration](automatic-migration-troubleshooting.md) for instructions on how to re-create the index with the correct ELSER inference endpoint.

0 commit comments

Comments
 (0)