[Fleet]: _hit$_source4.components.map is not a function error pop-up is repeatedly displayed on restarting service for Orphaned agents.

[amolnater-qasource]

Kibana Build details:

VERSION: 9.0.0 SNAPSHOT
BUILD: 82760
COMMIT: ba92d08a58d67bc832078f52c8401d9e66598220

Preconditions:

1. 9.0.0 SNAPSHOT Kibana cloud environment should be available.
2. A few agents should be installed with Elastic Defend.

Steps to reproduce:

1. Navigate to Agents tab.
2. Stop agent service so that agent gets into orphaned state.
3. Now restart the service and observe _hit$_source4.components.map is not a function error pop-up.

Expected Result:
_hit$_source4.components.map is not a function error pop-up should not be displayed on restarting service for Orphaned agents.

NOTE:

• Errors get resolved after sometime.

Screen Recording:

Agents.-.Fleet.-.Elastic.-.Google.Chrome.2025-01-17.10-28-09.mp4

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[amolnater-qasource]

@muskangulati-qasource Please review.

[muskangulati-qasource]

Secondary review is Done for this ticket!

[juliaElastic]

I've tried to reproduce locally on latest main, and not seeing the error.
@amolnater-qasource Do you you still have the cloud instance running where the error is reproduced? Could you share the login details? Thanks!

I found one place in the code where _source.components.map is used, probably comes from there, but this code hasn't changed for a long time: https://github.com/elastic/kibana/blob/fb8a17ba04f493cd5a0d0ba33c002750150fd0af/x-pack/platform/plugins/shared/fleet/server/services/agents/helpers.ts#L45

[amolnater-qasource]

Hi @juliaElastic

We have revalidated this issue on latest 9.0.0 SNAPSHOT and found it still reproducible.

Screen Recording:

Agents.-.Fleet.-.Elastic.-.Google.Chrome.2025-01-22.14-00-15.mp4

Build details:
VERSION: 9.0.0 SNAPSHOT
BUILD: 82885
COMMIT: 939c9fb71ee5c23c0e54b017fdea44ce0c6de5cb

Just an update that error is observed immediately after we start the Elastic Agent service which was in orphaned state.
Error will be visible for approximately 30 seconds.

Further, I'll be sharing the environment details with you over slack.

Thanks!!

[juliaElastic]

It seems that the root cause of this issue is that the agent components field has briefly a string value instead of array when restarting the orphaned agent. Added a fix in the UI so we don't show an error.
I'll transfer the issue to the agent repo to investigate why components is not an array.

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[kenza-ab]

Any update regarding this issue ?

[richlv]

For the record, we're hitting this on 8.17.2, cannot use a lot of the fleet functionality - fails both in the UI and via the API.

[juliaElastic]

The fix is available from 8.18.0.

[amolnater-qasource]

Hi Team,

We have revalidated this issue on latest 9.0-SNAPSHOT and found it fixed now.

Observations:

• No error pop-up is be displayed on restarting service for Orphaned agents.

Build details:
VERSION: 9.0.0 SNAPSHOT
BUILD: 84188
COMMIT: 5c231847869504d37f8f4f5ac098a42429ee854c

Screen Recording:

Agents.-.Fleet.-.Elastic.-.Google.Chrome.2025-03-27.16-15-32.mp4

Hence, we are closing and marking this issue as QA:Validated.

Thanks!