[kubernetes_otel]: Overview Dashboard panels using wrong breakdown (is: alphabetical, should be: count)

[JM-elastic]

Integration Name

Kubernetes OpenTelemetry Assets [kubernetes_otel]

Dataset Name

No response

Integration Version

2.0.0-preview

Agent Version

Serverless

Agent Output Type

elasticsearch

Elasticsearch Version

9.4.0 (Serverless)

OS Version and Architecture

Serverless

Software/API Version

Multiple K8s Clusters

Error Message

No response

Event Original

No response

What did you do?

I'm sending OTEL from multiple K8s clusters to Elastic Serverless, and I installed the K8s OTEL Integration 2.0-preview. For K8s-OTEL onboarding, I just copy/pasted the OTEL Operator instructions from my Serverless environment's K8s Quickstart page to my K8s clusters.

What did you see?

All of the Overview dashboard's timechart panels are breaking down values by alphabetical, and they should be breaking down values by count-desc. See screenshot. The associated panels in each of K8s Tabs (Nodes, Namespaces, Pods, etc.) all appear to be breaking down correctly by count.

What did you expect to see?

Overview page's panels should be breaking values down by count, not alphabetica.

Anything else?

No response

[github-actions]

The strongest actionable lead is that this may be related to the recent Check Point firewall ingest regression/fix around packets tuple parsing and packet_amount mapping; if your report is about Check Point firewall events failing to ingest or missing packet counts, this is likely a duplicate/near-duplicate of #18191.

Recommendation
Treat this as potentially related to the existing Check Point firewall ingest work first. If the reported behavior is in that area, validate against package version 1.45.4+ and close as duplicate/related to #18191; otherwise, ask for concrete reproduction details (integration, data stream, sample event, expected vs actual) before implementation.

Findings

1. Recent bugfix explicitly matches a known ingest-failure pattern in Check Point firewall:

   • packages/checkpoint/changelog.yml:2-6
   • 1.45.4 notes: “Prevent firewall ingest failures when packets contains tuple data and map packet counts from packet_amount.”
   • linked issue: https://github.com/elastic/integrations/issues/18191

2. Ingest pipeline contains the corresponding parsing/mapping logic:

   • packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml:1021-1063 (script_parse_checkpoint_packets_dropped)
   • .../default.yml:1077-1087 (checkpoint.packet_amount conversion and fallback to network.packets)

3. Triage workflow in this repo delegates to upstream reusable workflow:

   • .github/workflows/trigger-issue-triage.yml:20
   • So issue-body handling problems are likely upstream if content access is restricted during automation.

Verification

I validated the code references and ran a scoped test suite:

$ git --no-pager grep -n "https://github.com/elastic/integrations/issues/18191\|packet_amount\|script_parse_checkpoint_packets_dropped" \
  packages/checkpoint/changelog.yml \
  packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml \
  .github/workflows/trigger-issue-triage.yml
packages/checkpoint/changelog.yml:4:... packets contains tuple data and map packet counts from packet_amount.
packages/checkpoint/changelog.yml:6:.../issues/18191
packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml:1022: tag: script_parse_checkpoint_packets_dropped
packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml:1077: tag: convert_checkpoint_packet_amount_ff3e9341
packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml:1087: if: ctx.network?.packets == null && ctx.checkpoint?.packet_amount instanceof Number

$ go test ./dev/... -count=1
ok  github.com/elastic/integrations/dev/citools        0.018s
ok  github.com/elastic/integrations/dev/codeowners     0.010s
ok  github.com/elastic/integrations/dev/coverage       0.015s
ok  github.com/elastic/integrations/dev/import-beats   0.010s
ok  github.com/elastic/integrations/dev/testsreporter  0.009s

Detailed Action Plan

1. Confirm whether the report is specifically for Check Point firewall (packages/checkpoint/data_stream/firewall).
2. If yes, compare reporter’s package version with 1.45.4 (packages/checkpoint/changelog.yml:2) and request a raw sample event that reproduces the failure.
3. Reproduce with that event against default.yml packet logic at:
   • tuple parsing script (1021-1063)
   • packet_amount to network.packets fallback (1077-1087)
4. If behavior matches the already-fixed path, close as duplicate/related to #18191 and recommend upgrade.
5. If behavior differs, open a focused follow-up bug scoped to those lines with exact failing payload and expected fields.

Related Items

Type	Link / File	Relevance
Issue	#18191	Existing Check Point firewall ingest failure fix referenced in changelog
File	packages/checkpoint/changelog.yml:2-6	Documents 1.45.4 bugfix details
File	packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml:1021-1087	Parsing and mapping logic for the affected fields
File	.github/workflows/trigger-issue-triage.yml:20	Shows triage workflow delegation to upstream reusable workflow

Note

🔒 Integrity filtering filtered 22 items

Integrity filtering activated and filtered the following items during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

• issue:[kubernetes_otel]: Overview Dashboard panels using wrong breakdown (is: alphabetical, should be: count) #18208 (issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #18208 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:[kubernetes_otel]: Overview Dashboard panels using wrong breakdown (is: alphabetical, should be: count) #18208 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:[breaking-change] Undocumented breaking changes detected (2026-04-02) #18206 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:[bug-hunter] notify-package-docs-failure can skip commenting on the triggering PR when a commit belongs to multiple PRs #18204 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:[text-auditor] Batch fix clear user-facing typos in docs and one runtime error string #18202 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:[docs-patrol] Update m365_defender README for optional incident alert expansion #18201 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:[dashboard-data-scope] Gigamon dashboards contain stale Lens data-view ID causing broken panel sources #18200 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:[Stack 9.4.0-SNAPSHOT] [cloudflare_logpush] Failing test daily: system test: aws-s3 in cloudflare_logpush.magic_ids #18197 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:netskope: missing content_type and override_content type configs in transaction data stream #18193 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:[Integration Name]: Cloudflare R2 Logpush fails in 8.19.12 due to missing region (non-AWS S3) beats#50021 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• issue:Add documentation on agent version conditions in packages #18186 (list_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #17977 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #18066 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #18192 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• #17046 (search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
• ... and 6 more items

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.