Stop legacy query packs from spamming errors (#24491)

#24386

changes/24386-fleet-legacy-query-pack

@@ -0,0 +1 @@
+- Stop older scheduled queries from filling logs with errors

server/fleet/osquery.go

@@ -1,5 +1,7 @@
 package fleet
 
+import "errors"
+
 // OsqueryDistributedQueryResults represents the format of the results of an
 // osquery distributed query.
 type OsqueryDistributedQueryResults map[string][]map[string]string
@@ -8,6 +10,8 @@ type OsqueryDistributedQueryResults map[string][]map[string]string
 // failure)
 type OsqueryStatus int
 
+var ErrLegacyQueryPack = errors.New("legacy query pack, storage not supported")
+
 // Stats contains the performance statistics about the execution of a specific osquery query.
 type Stats struct {
 	WallTimeMs uint64 `json:"wall_time_ms"`

server/service/osquery.go

@@ -2145,6 +2145,11 @@ func (svc *Service) preProcessOsqueryResults(
 			continue
 		}
 		teamID, queryName, err := getQueryNameAndTeamIDFromResult(queryResult.QueryName)
+		if errors.Is(err, fleet.ErrLegacyQueryPack) {
+			// Legacy query. Cannot be stored and cannot
+			// infer team ID, but still used by some customers
+			continue
+		}
 		if err != nil {
 			level.Debug(svc.logger).Log("msg", "querying name and team ID from result", "err", err)
 			continue
@@ -2456,6 +2461,13 @@ func getQueryNameAndTeamIDFromResult(path string) (*uint, string, error) {
 		// 2017/legacy packs with the format "pack/<Pack name>/<Query name> are
 		// considered unknown format (they are not considered global or team
 		// scheduled queries).
+
+		// We can't infer the team from this and it can't be stored, but it's still valid
+		if strings.HasPrefix(path, "pack/") && strings.Count(path, "/") == 2 {
+			return nil, "", fleet.ErrLegacyQueryPack
+		}
+
+		// Truly unknown
 		return nil, "", fmt.Errorf("unknown format: %q", path)
 	}