ti_*: Use num_failure_retries instead of unattended mode

[kcreddy]

Proposed commit message

ti_*: use num_failure_retries instead of unattended mode

Replace settings.unattended: true with settings.num_failure_retries: -1
in all ti_* managed transforms. Unlike unattended mode which retries
all failures indefinitely (masking irrecoverable errors),
num_failure_retries: -1 retries only recoverable failures while still
surfacing genuinely irrecoverable ones to users.

Three packages (ti_anyrun, ti_flashpoint, ti_strider) that were added
after the original unattended PR (#16535) had no failure resilience at
all and now get num_failure_retries: -1 added.

[git-generate]
for transform in $(find packages/ti_*/ -type f -name transform.yml \
  -path '*/elasticsearch/transform/*'); do
    yq -i 'del(.settings.unattended)' "$transform"
    yq -i '.settings.num_failure_retries = -1' "$transform"
done

for transform in $(git diff --name-only packages/ | \
  grep 'transform\.yml$'); do
    current=$(yq '._meta.fleet_transform_version' "$transform")
    next=$(echo "$current" | awk -F. '{printf "%d.%d.%d",$1,$2+1,0}')
    yq -i "._meta.fleet_transform_version = \"$next\"" "$transform"
done

for pkg in $(git diff --name-only packages/ | cut -d/ -f1,2 | \
  sort -u); do
    cd "$pkg"
    elastic-package changelog add \
      --description "Use num_failure_retries instead of unattended mode for transform failure recovery." \
      --type enhancement --next minor \
      --link "https://github.com/elastic/integrations/pull/18404"
    cd ../../
done

Summary

Switches all ti_* managed transforms from settings.unattended: true to settings.num_failure_retries: -1.

• unattended: true retries all failures indefinitely, including irrecoverable ones, which masks real problems from users.
• num_failure_retries: -1 retries only recoverable failures indefinitely (network blips, transient cluster instability) while still surfacing irrecoverable errors.

This covers 52 transforms across 23 packages. Three packages (ti_anyrun, ti_flashpoint, ti_strider) were added after the original unattended PR (#16535) and had no failure resilience at all -- they now get num_failure_retries: -1 for the first time.

Changes per package

For each affected transform:

1. Removed settings.unattended: true
2. Added settings.num_failure_retries: -1
3. Bumped _meta.fleet_transform_version (minor bump triggers reinstall)
4. Added a changelog entry

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

• Relates https://github.com/elastic/security-team/issues/14926
• Relates Update Transform spec from upstream elasticsearch-specification package-spec#1124
• Relates ti_*: Allow transforms to run unattended mode #16535 (added unattended: true)
• Closes ti_*: Replace unattended: true with num_failure_retries: -1 in all managed transforms #18403

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: f441298

Failed CI Steps

• Check integrations ti_abusech
• Check integrations ti_anomali
• Check integrations ti_anyrun
• Check integrations ti_cif3
• Check integrations ti_crowdstrike
• Check integrations ti_custom
• Check integrations ti_cybersixgill
• Check integrations ti_cyware_intel_exchange
• Check integrations ti_domaintools
• Check integrations ti_eclecticiq
• Check integrations ti_eset
• Check integrations ti_flashpoint
• Check integrations ti_google_threat_intelligence
• Check integrations ti_greynoise
• Check integrations ti_maltiverse
• Check integrations ti_misp
• Check integrations ti_opencti
• Check integrations ti_otx
• Check integrations ti_rapid7_threat_command
• Check integrations ti_recordedfuture
• Check integrations ti_strider
• Check integrations ti_threatconnect
• Check integrations ti_threatq

History

cc @kcreddy