diff --git a/docs/action-type-template.asciidoc b/docs/action-type-template.asciidoc index 5b61c259563ad..f477fb06c007f 100644 --- a/docs/action-type-template.asciidoc +++ b/docs/action-type-template.asciidoc @@ -1,10 +1,10 @@ [[-action-type]] -=== action +=== connector and action ++++ ++++ -Include a short description of the action type. +Include a short description of the connector type. [float] [[-connector-configuration]] @@ -13,7 +13,7 @@ Include a short description of the action type. connectors have the following configuration properties. //// -List of user-facing connector configurations. This should align with the fields available in the Create connector flyout form for this action type. +List of user-facing connector configurations. This should align with the fields available in the Create connector flyout form for this connector type. //// Property1:: A short description of this property. @@ -21,16 +21,16 @@ Property2:: A short description of this property with format hints. This can be [float] [[Preconfigured--configuration]] -==== Preconfigured action type +==== Preconfigured connector type //// -Example preconfigured format for this action type +Example preconfigured format for this connector type //// [source,text] -- my-: - name: preconfigured--action-type + name: preconfigured--connector-type actionTypeId: . config: property1: value1 @@ -39,17 +39,15 @@ Example preconfigured format for this action type property3: value3 -- -[float] -[[-connector-config-properties]] //// List of properties from the ConfigSchema and SecretsSchema for this action type. //// -Config defines information for the action type. +Config defines information for the connector type. `property1`:: A short description of this property. `property2`:: A short descriptionn of this property. -Secrets defines sensitive information for the action type. +Secrets defines sensitive information for the connector type. `property3`:: A short descriptionn of this property. @@ -57,7 +55,7 @@ Secrets defines sensitive information for the action type. [[-action-configuration]] ==== Action configuration - actions have the following configuration properties. + actions have the following properties. //// List of user-facing action configurations. This should align with the fields available in the Action section of the Create/Update alert flyout. diff --git a/docs/alert-type-template.asciidoc b/docs/alert-type-template.asciidoc deleted file mode 100644 index 292ed00d05496..0000000000000 --- a/docs/alert-type-template.asciidoc +++ /dev/null @@ -1,39 +0,0 @@ -[[alert-type-]] -=== - -Include a short description of the alert type. - -[float] -==== Create the alert - -Fill in the <>, then select **. - -[float] -==== Define the conditions - -Define properties to detect the condition. - -//// -Optional, include a screenshot -[role="screenshot"] -image::user/alerting/images/alert-types--conditions.png[Conditions for alert type] -//// - -Condition1:: This is a condition the user must define. -Condition2:: This is another condition the user must define. - -[float] -==== Add action variables - -<> to run when the alert condition is met. The following variables are specific to the alert. You can also specify <>. - -`context.variableA`:: A short description of the context variable defined by the alert type. -`context.variableB`:: A short description of the context variable defined by the alert type with an example. Example: `this is what variableB outputs`. - -//// -Optional, include a step-by-step example for creating this alert -[float] -==== Example - -In this section, you will use the {kib} <> to setup and tune the conditions on an alert. For this example, we want to detect when . -//// \ No newline at end of file diff --git a/docs/management/alerting/alert-details.asciidoc b/docs/management/alerting/alert-details.asciidoc deleted file mode 100644 index 0510b90272f90..0000000000000 --- a/docs/management/alerting/alert-details.asciidoc +++ /dev/null @@ -1,33 +0,0 @@ -[role="xpack"] -[[alert-details]] -=== Alert details - - -The *Alert details* page tells you about the state of the alert and provides granular control over the actions it is taking. - -[role="screenshot"] -image::images/alerts-details-instances-active.png[Alert details page with three alert instances] - -In this example, alerts detect when a site serves more than a threshold number of bytes in a 24 hour period. Three sites are above the threshold. These are called alert instances - occurrences of the condition being detected - and the instance name, status, time of detection, and duration of the condition are shown in this view. - -Upon detection, each instance can trigger one or more actions. If the condition persists, the same actions will trigger either on the next scheduled alert check, or (if defined) after the re-notify period on the alert has passed. To prevent re-notification, you can suppress future actions by clicking on the eye icon to mute an individual alert instance. Muting means that the alert checks continue to run on a schedule, but that instance will not trigger any action. - -[role="screenshot"] -image::images/alerts-details-instance-muting.png[Muting an alert instance] - -Alert instances will come and go from the list depending on whether they meet the alert conditions or not - unless they are muted. If a muted instance no longer meets the alert conditions, it will appear as inactive in the list. This prevents an instance from triggering actions if it reappears in the future. - -[role="screenshot"] -image::images/alerts-details-instances-inactive.png[Alert details page with three inactive alert instances] - -If you want to suppress actions on all current and future instances, you can mute the entire alert. Alert checks continue to run and the instance list will update as instances activate or deactivate, but no actions will be triggered. - -[role="screenshot"] -image::images/alerts-details-muting.png[Use the mute toggle to suppress all action on current and future instances] - -You can also disable an alert altogether. When disabled, the alert stops running checks altogether and will clear any instances it is tracking. You may want to disable alerts that are not currently needed to reduce the load on {kib} and {es}. - -[role="screenshot"] -image::images/alerts-details-disabling.png[Use the disable toggle to turn off alert checks and clear instances tracked] - -* For further information on alerting concepts and examples, see <>. diff --git a/docs/management/alerting/alert-management.asciidoc b/docs/management/alerting/alert-management.asciidoc deleted file mode 100644 index 4fd1d8a7182db..0000000000000 --- a/docs/management/alerting/alert-management.asciidoc +++ /dev/null @@ -1,58 +0,0 @@ -[role="xpack"] -[[alert-management]] -=== Managing Alerts - - -The *Alerts* tab provides a cross-app view of alerting. Different {kib} apps like {observability-guide}/create-alerts.html[*Observability*], {security-guide}/prebuilt-rules.html[*Security*], <> and <> can offer their own alerts. The *Alerts* tab provides a central place to: - -* <> alerts -* <> including enabling/disabling, muting/unmuting, and deleting -* Drill-down to <> - -[role="screenshot"] -image:management/alerting/images/alerts-and-actions-ui.png[Example alert listing in the Alerts and Actions UI] - -For more information on alerting concepts and the types of alerts and actions available, see <>. - -[float] -==== Finding alerts - -The *Alerts* tab lists all alerts in the current space, including summary information about their execution frequency, tags, and type. - -The *search bar* can be used to quickly find alerts by name or tag. - -[role="screenshot"] -image::images/alerts-filter-by-search.png[Filtering the alerts list using the search bar] - -The *type* dropdown lets you filter to a subset of alert types. - -[role="screenshot"] -image::images/alerts-filter-by-type.png[Filtering the alerts list by types of alert] - -The *Action type* dropdown lets you filter by the type of action used in the alert. - -[role="screenshot"] -image::images/alerts-filter-by-action-type.png[Filtering the alert list by type of action] - -[float] -[[create-edit-alerts]] -==== Creating and editing alerts - -Many alerts must be created within the context of a {kib} app like <>, <>, or <>, but others are generic. Generic alert types can be created in the *Alerts* management UI by clicking the *Create* button. This will launch a flyout that guides you through selecting an alert type and configuring it's properties. Refer to <> for details on what types of alerts are available and how to configure them. - -After an alert is created, you can re-open the flyout and change an alerts properties by clicking the *Edit* button shown on each row of the alert listing. - - -[float] -[[controlling-alerts]] -==== Controlling alerts - -The alert listing allows you to quickly mute/unmute, disable/enable, and delete individual alerts by clicking the action button. - -[role="screenshot"] -image:management/alerting/images/individual-mute-disable.png[The actions button allows an individual alert to be muted, disabled, or deleted] - -These operations can also be performed in bulk by multi-selecting alerts and clicking the *Manage alerts* button: - -[role="screenshot"] -image:management/alerting/images/bulk-mute-disable.png[The Manage alerts button lets you mute/unmute, enable/disable, and delete in bulk] diff --git a/docs/management/alerting/alerts-and-actions-intro.asciidoc b/docs/management/alerting/alerts-and-actions-intro.asciidoc deleted file mode 100644 index 2352cb99bf543..0000000000000 --- a/docs/management/alerting/alerts-and-actions-intro.asciidoc +++ /dev/null @@ -1,30 +0,0 @@ -[role="xpack"] -[[managing-alerts-and-actions]] -== Alerts and Actions - - -The *Alerts and Actions* UI lets you <> in a space, and provides tools to <> so that alerts can trigger actions like notification, indexing, and ticketing. - -To manage alerting and connectors, open the main menu, -then click *Stack Management > Alerts and Insights > Alerts and Actions*. - -[role="screenshot"] -image:management/alerting/images/alerts-and-actions-ui.png[Example alert listing in the Alerts and Actions UI] - -[NOTE] -============================================================================ -Similar to dashboards, alerts and connectors reside in a <>. -The *Alerts and Actions* UI only shows alerts and connectors for the current space. -============================================================================ - -[NOTE] -============================================================================ -{es} also offers alerting capabilities through Watcher, which -can be managed through the <>. See -<> for more information. -============================================================================ - -[float] -=== Required permissions - -Access to alerts and actions is granted based on your privileges to alerting-enabled features. See <> for more information. diff --git a/docs/management/alerting/connector-management.asciidoc b/docs/management/alerting/connector-management.asciidoc index 46e106e6e9648..dd3b5209ed4a0 100644 --- a/docs/management/alerting/connector-management.asciidoc +++ b/docs/management/alerting/connector-management.asciidoc @@ -2,14 +2,12 @@ [[connector-management]] === Managing Connectors -beta[] - -Alerts use *Connectors* to route actions to different destinations like log files, ticketing systems, and messaging tools. While each {kib} app can offer their own types of alerts, they typically share connectors. The *Connectors* tab offers a central place to view and manage all the connectors in the current space. +Rules use *Connectors* to route actions to different destinations like log files, ticketing systems, and messaging tools. While each {kib} app can offer their own types of rules, they typically share connectors. The *Connectors* tab offers a central place to view and manage all the connectors in the current space. For more information on connectors and the types of actions available see <>. [role="screenshot"] -image::images/connector-listing.png[Example connector listing in the Alerts and Actions UI] +image::images/connector-listing.png[Example connector listing in the Rules and Connectors UI] [float] @@ -21,15 +19,10 @@ The *Connectors* tab lists all connectors in the current space. The *search bar* image::images/connector-filter-by-search.png[Filtering the connector list using the search bar] -The *type* dropdown also lets you filter to a subset of action types. - -[role="screenshot"] -image::images/connector-filter-by-type.png[Filtering the connector list by types of actions] - -The *Actions* column indicates the number of actions that reference the connector. This count helps you confirm a connector is unused before you delete it, and tells you how many actions will be affected when a connector is modified. +The *type* dropdown also lets you filter to a subset of connector types. [role="screenshot"] -image::images/connector-action-count.png[Filtering the connector list by types of actions] +image::images/connector-filter-by-type.png[Filtering the connector list by types of connectors] You can delete individual connectors using the trash icon. Connectors can also be deleted in bulk by multi-selecting them and clicking the *Delete* button to the left of the search box. @@ -44,4 +37,4 @@ When this happens the action will fail to execute, and appear as errors in the { ==== Creating a new connector -New connectors can be created by clicking the *Create connector* button, which will guide you to select the type of connector and configure it's properties. Refer to <> for the types of connectors available and how to configure them. Once you create a connector it will be made available to you anytime you set up an action in the current space. +New connectors can be created by clicking the *Create connector* button, which will guide you to select the type of connector and configure its properties. Refer to <> for the types of connectors available and how to configure them. Once you create a connector it will be made available to you anytime you set up an action in the current space. diff --git a/docs/management/alerting/images/alerts-and-actions-ui.png b/docs/management/alerting/images/alerts-and-actions-ui.png deleted file mode 100644 index d46df21e6f6b0..0000000000000 Binary files a/docs/management/alerting/images/alerts-and-actions-ui.png and /dev/null differ diff --git a/docs/management/alerting/images/alerts-details-instances-active.png b/docs/management/alerting/images/alerts-details-instances-active.png deleted file mode 100644 index 7506d1cb8c65e..0000000000000 Binary files a/docs/management/alerting/images/alerts-details-instances-active.png and /dev/null differ diff --git a/docs/management/alerting/images/alerts-details-instances-inactive.png b/docs/management/alerting/images/alerts-details-instances-inactive.png deleted file mode 100644 index a757d59e12360..0000000000000 Binary files a/docs/management/alerting/images/alerts-details-instances-inactive.png and /dev/null differ diff --git a/docs/management/alerting/images/alerts-details-muting.png b/docs/management/alerting/images/alerts-details-muting.png deleted file mode 100644 index 29cdf707b4912..0000000000000 Binary files a/docs/management/alerting/images/alerts-details-muting.png and /dev/null differ diff --git a/docs/management/alerting/images/alerts-filter-by-action-type.png b/docs/management/alerting/images/alerts-filter-by-action-type.png deleted file mode 100644 index c0e495a87ecd3..0000000000000 Binary files a/docs/management/alerting/images/alerts-filter-by-action-type.png and /dev/null differ diff --git a/docs/management/alerting/images/alerts-filter-by-search.png b/docs/management/alerting/images/alerts-filter-by-search.png deleted file mode 100644 index df4b6d7d9d9aa..0000000000000 Binary files a/docs/management/alerting/images/alerts-filter-by-search.png and /dev/null differ diff --git a/docs/management/alerting/images/bulk-mute-disable.png b/docs/management/alerting/images/bulk-mute-disable.png index 04cdc3f03f34d..7ac4ac8fc3daf 100644 Binary files a/docs/management/alerting/images/bulk-mute-disable.png and b/docs/management/alerting/images/bulk-mute-disable.png differ diff --git a/docs/management/alerting/images/connector-filter-by-search.png b/docs/management/alerting/images/connector-filter-by-search.png index 1f052ea23a577..97348e70d91b3 100644 Binary files a/docs/management/alerting/images/connector-filter-by-search.png and b/docs/management/alerting/images/connector-filter-by-search.png differ diff --git a/docs/management/alerting/images/connector-filter-by-type.png b/docs/management/alerting/images/connector-filter-by-type.png index 06c7d6f4dad47..b95ef4e1a2e3e 100644 Binary files a/docs/management/alerting/images/connector-filter-by-type.png and b/docs/management/alerting/images/connector-filter-by-type.png differ diff --git a/docs/management/alerting/images/connector-listing.png b/docs/management/alerting/images/connector-listing.png index 43014ff88057f..68a529e16aa76 100644 Binary files a/docs/management/alerting/images/connector-listing.png and b/docs/management/alerting/images/connector-listing.png differ diff --git a/docs/management/alerting/images/individual-mute-disable.png b/docs/management/alerting/images/individual-mute-disable.png index dc187c97de309..0ed2bfc0186c0 100644 Binary files a/docs/management/alerting/images/individual-mute-disable.png and b/docs/management/alerting/images/individual-mute-disable.png differ diff --git a/docs/management/alerting/images/alerts-details-instance-muting.png b/docs/management/alerting/images/rule-details-alert-muting.png similarity index 100% rename from docs/management/alerting/images/alerts-details-instance-muting.png rename to docs/management/alerting/images/rule-details-alert-muting.png diff --git a/docs/management/alerting/images/rule-details-alerts-active.png b/docs/management/alerting/images/rule-details-alerts-active.png new file mode 100644 index 0000000000000..205fe533c1b4d Binary files /dev/null and b/docs/management/alerting/images/rule-details-alerts-active.png differ diff --git a/docs/management/alerting/images/rule-details-alerts-inactive.png b/docs/management/alerting/images/rule-details-alerts-inactive.png new file mode 100644 index 0000000000000..f84910ae0dcdc Binary files /dev/null and b/docs/management/alerting/images/rule-details-alerts-inactive.png differ diff --git a/docs/management/alerting/images/alerts-details-disabling.png b/docs/management/alerting/images/rule-details-disabling.png similarity index 100% rename from docs/management/alerting/images/alerts-details-disabling.png rename to docs/management/alerting/images/rule-details-disabling.png diff --git a/docs/management/alerting/images/rule-details-muting.png b/docs/management/alerting/images/rule-details-muting.png new file mode 100644 index 0000000000000..c19db43a854eb Binary files /dev/null and b/docs/management/alerting/images/rule-details-muting.png differ diff --git a/docs/management/alerting/images/rules-and-connectors-ui.png b/docs/management/alerting/images/rules-and-connectors-ui.png new file mode 100644 index 0000000000000..3a464fa7cf375 Binary files /dev/null and b/docs/management/alerting/images/rules-and-connectors-ui.png differ diff --git a/docs/management/alerting/images/rules-filter-by-action-type.png b/docs/management/alerting/images/rules-filter-by-action-type.png new file mode 100644 index 0000000000000..eded89a81dd37 Binary files /dev/null and b/docs/management/alerting/images/rules-filter-by-action-type.png differ diff --git a/docs/management/alerting/images/rules-filter-by-search.png b/docs/management/alerting/images/rules-filter-by-search.png new file mode 100644 index 0000000000000..8bda3602c98b9 Binary files /dev/null and b/docs/management/alerting/images/rules-filter-by-search.png differ diff --git a/docs/management/alerting/images/alerts-filter-by-type.png b/docs/management/alerting/images/rules-filter-by-type.png similarity index 100% rename from docs/management/alerting/images/alerts-filter-by-type.png rename to docs/management/alerting/images/rules-filter-by-type.png diff --git a/docs/management/alerting/rule-details.asciidoc b/docs/management/alerting/rule-details.asciidoc new file mode 100644 index 0000000000000..a893db280c7f7 --- /dev/null +++ b/docs/management/alerting/rule-details.asciidoc @@ -0,0 +1,33 @@ +[role="xpack"] +[[rule-details]] +=== Rule details + + +The *Rule details* page tells you about the state of the rule and provides granular control over the actions it is taking. + +[role="screenshot"] +image::images/rule-details-alerts-active.png[Rule details page with three alerts] + +In this example, the rule detects when a site serves more than a threshold number of bytes in a 24 hour period. Three sites are above the threshold. These are called alerts - occurrences of the condition being detected - and the alert name, status, time of detection, and duration of the condition are shown in this view. + +Upon detection, each alert can trigger one or more actions. If the condition persists, the same actions will trigger either on the next scheduled rule check, or (if defined) after the re-notify period on the rule has passed. To prevent re-notification, you can suppress future actions by clicking on the eye icon to mute an individual alert. Muting means that the rule checks continue to run on a schedule, but that alert will not trigger any action. + +[role="screenshot"] +image::images/rule-details-alert-muting.png[Muting an alert] + +Alerts will come and go from the list depending on whether they meet the rule conditions or not - unless they are muted. If a muted instance no longer meets the rule conditions, it will appear as inactive in the list. This prevents an alert from triggering actions if it reappears in the future. + +[role="screenshot"] +image::images/rule-details-alerts-inactive.png[Rule details page with three inactive alerts] + +If you want to suppress actions on all current and future alerts, you can mute the entire rule. Rule checks continue to run and the alert list will update as alerts activate or deactivate, but no actions will be triggered. + +[role="screenshot"] +image::images/rule-details-muting.png[Use the mute toggle to suppress all actions on current and future alerts] + +You can also disable a rule altogether. When disabled, the rule stops running checks altogether and will clear any alerts it is tracking. You may want to disable rules that are not currently needed to reduce the load on {kib} and {es}. + +[role="screenshot"] +image::images/rule-details-disabling.png[Use the disable toggle to turn off rule checks and clear alerts tracked] + +* For further information on alerting concepts and examples, see <>. diff --git a/docs/management/alerting/rule-management.asciidoc b/docs/management/alerting/rule-management.asciidoc new file mode 100644 index 0000000000000..b43dc9eb635e9 --- /dev/null +++ b/docs/management/alerting/rule-management.asciidoc @@ -0,0 +1,58 @@ +[role="xpack"] +[[alert-management]] +=== Managing Rules + + +The *Rules* tab provides a cross-app view of alerting. Different {kib} apps like {observability-guide}/create-alerts.html[*Observability*], {security-guide}/prebuilt-rules.html[*Security*], <> and <> can offer their own rules. The *Rules* tab provides a central place to: + +* <> rules +* <> including enabling/disabling, muting/unmuting, and deleting +* Drill-down to <> + +[role="screenshot"] +image:management/alerting/images/rules-and-connectors-ui.png[Example rule listing in the Rules and Connectors UI] + +For more information on alerting concepts and the types of rules and connectors available, see <>. + +[float] +==== Finding rules + +The *Rules* tab lists all rules in the current space, including summary information about their execution frequency, tags, and type. + +The *search bar* can be used to quickly find rules by name or tag. + +[role="screenshot"] +image::images/rules-filter-by-search.png[Filtering the rules list using the search bar] + +The *type* dropdown lets you filter to a subset of rule types. + +[role="screenshot"] +image::images/rules-filter-by-type.png[Filtering the rules list by types of rule] + +The *Action type* dropdown lets you filter by the type of action used in the rule. + +[role="screenshot"] +image::images/rules-filter-by-action-type.png[Filtering the rule list by type of action] + +[float] +[[create-edit-rules]] +==== Creating and editing rules + +Many rules must be created within the context of a {kib} app like <>, <>, or <>, but others are generic. Generic rule types can be created in the *Rules* management UI by clicking the *Create* button. This will launch a flyout that guides you through selecting a rule type and configuring its properties. Refer to <> for details on what types of rules are available and how to configure them. + +After a rule is created, you can re-open the flyout and change a rule's properties by clicking the *Edit* button shown on each row of the rule listing. + + +[float] +[[controlling-rules]] +==== Controlling rules + +The rule listing allows you to quickly mute/unmute, disable/enable, and delete individual rules by clicking the action button. + +[role="screenshot"] +image:management/alerting/images/individual-mute-disable.png[The actions button allows an individual rule to be muted, disabled, or deleted] + +These operations can also be performed in bulk by multi-selecting rules and clicking the *Manage rules* button: + +[role="screenshot"] +image:management/alerting/images/bulk-mute-disable.png[The Manage rules button lets you mute/unmute, enable/disable, and delete in bulk] diff --git a/docs/management/alerting/rules-and-connectors-intro.asciidoc b/docs/management/alerting/rules-and-connectors-intro.asciidoc new file mode 100644 index 0000000000000..6e23ca95e2266 --- /dev/null +++ b/docs/management/alerting/rules-and-connectors-intro.asciidoc @@ -0,0 +1,29 @@ +[role="xpack"] +[[managing-alerts-and-actions]] +== Rules and Connectors + + +The *Rules and Connectors* UI lets you <> in a space, and provides tools to <> so that rules can trigger actions like notification, indexing, and ticketing. + +To manage rules and connectors, open the main menu, then click *Stack Management > Alerts and Insights > Rules and Connectors*. + +[role="screenshot"] +image:management/alerting/images/rules-and-connectors-ui.png[Example rule listing in the Rules and Connectors UI] + +[NOTE] +============================================================================ +Similar to dashboards, rules and connectors reside in a <>. +The *Rules and Connectors* UI only shows rules and connectors for the current space. +============================================================================ + +[NOTE] +============================================================================ +{es} also offers alerting capabilities through Watcher, which +can be managed through the <>. See +<> for more information. +============================================================================ + +[float] +=== Required permissions + +Access to rules and connectors is granted based on your privileges to alerting-enabled features. See <> for more information. diff --git a/docs/rule-type-template.asciidoc b/docs/rule-type-template.asciidoc new file mode 100644 index 0000000000000..605bdd57c1492 --- /dev/null +++ b/docs/rule-type-template.asciidoc @@ -0,0 +1,39 @@ +[[rule-type-]] +=== + +Include a short description of the rule type. + +[float] +==== Create the rule + +Fill in the <>, then select **. + +[float] +==== Define the conditions + +Define properties to detect the condition. + +//// +Optional, include a screenshot +[role="screenshot"] +image::user/alerting/images/rule-types--conditions.png[Conditions for rule type] +//// + +Condition1:: This is a condition the user must define. +Condition2:: This is another condition the user must define. + +[float] +==== Add action variables + +<> to run when the rule condition is met. The following variables are specific to the rule. You can also specify <>. + +`context.variableA`:: A short description of the context variable defined by the rule type. +`context.variableB`:: A short description of the context variable defined by the rule type with an example. Example: `this is what variableB outputs`. + +//// +Optional, include a step-by-step example for creating this rule +[float] +==== Example + +In this section, you will use the {kib} <> to setup and tune the conditions on an rule. For this example, we want to detect when . +//// \ No newline at end of file diff --git a/docs/settings/alert-action-settings.asciidoc b/docs/settings/alert-action-settings.asciidoc index 6813a77776b5b..3645499d5f9ff 100644 --- a/docs/settings/alert-action-settings.asciidoc +++ b/docs/settings/alert-action-settings.asciidoc @@ -23,14 +23,14 @@ You can configure the following settings in the `kibana.yml` file. | `xpack.encryptedSavedObjects` `.encryptionKey` - | A string of 32 or more characters used to encrypt sensitive properties on alerts and actions before they're stored in {es}. Third party credentials — such as the username and password used to connect to an SMTP service — are an example of encrypted properties. + + | A string of 32 or more characters used to encrypt sensitive properties on alerting rules and actions before they're stored in {es}. Third party credentials — such as the username and password used to connect to an SMTP service — are an example of encrypted properties. + + {kib} offers a <> to help generate this encryption key. + + - If not set, {kib} will generate a random key on startup, but all alert and action functions will be blocked. Generated keys are not allowed for alerts and actions because when a new key is generated on restart, existing encrypted data becomes inaccessible. For the same reason, alerts and actions in high-availability deployments of {kib} will behave unexpectedly if the key isn't the same on all instances of {kib}. + + If not set, {kib} will generate a random key on startup, but all alerting and action functions will be blocked. Generated keys are not allowed for alerting and actions because when a new key is generated on restart, existing encrypted data becomes inaccessible. For the same reason, alerting and actions in high-availability deployments of {kib} will behave unexpectedly if the key isn't the same on all instances of {kib}. + + Although the key can be specified in clear text in `kibana.yml`, it's recommended to store this key securely in the <>. - Be sure to back up the encryption key value somewhere safe, as your alerts and actions will cease to function due to decryption failures should you lose it. If you want to rotate the encryption key, be sure to follow the instructions on <>. + Be sure to back up the encryption key value somewhere safe, as your alerting rules and actions will cease to function due to decryption failures should you lose it. If you want to rotate the encryption key, be sure to follow the instructions on <>. |=== @@ -75,6 +75,6 @@ a|`xpack.actions.` [float] [[alert-settings]] -==== Alert settings +==== Alerting settings You do not need to configure any additional settings to use alerting in {kib}. diff --git a/docs/user/alerting/action-types.asciidoc b/docs/user/alerting/action-types.asciidoc index 586feeb032cb4..b648f5a9ccde5 100644 --- a/docs/user/alerting/action-types.asciidoc +++ b/docs/user/alerting/action-types.asciidoc @@ -1,8 +1,8 @@ [role="xpack"] [[action-types]] -== Actions and connectors +== Connectors and actions -Actions are Kibana services or integrations with third-party systems that run as background tasks on the Kibana server when alert conditions are met. {kib} provides the following types of actions: +Connectors provide a central place to store connection information for services and integrations with third party systems. Actions are instantiations of a connector that are linked to rules and run as background tasks on the {kib} server when rule conditions are met. {kib} provides the following types of connectors: [cols="2"] |=== @@ -50,20 +50,18 @@ a| <> [NOTE] ============================================== -Some action types are paid commercial features, while others are free. +Some connector types are paid commercial features, while others are free. For a comparison of the Elastic subscription levels, see https://www.elastic.co/subscriptions[the subscription page]. ============================================== [float] [[create-connectors]] -=== Preconfigured actions and connectors +=== Preconfigured connectors -For out-of-the-box and standardized connectors, you can <> +For out-of-the-box and standardized connectors, you can <> before {kib} starts. -If you preconfigure a connector, you can also <>. - include::action-types/email.asciidoc[] include::action-types/resilient.asciidoc[] include::action-types/index.asciidoc[] diff --git a/docs/user/alerting/action-types/email.asciidoc b/docs/user/alerting/action-types/email.asciidoc index 3813eccd048d9..58f1300d0c287 100644 --- a/docs/user/alerting/action-types/email.asciidoc +++ b/docs/user/alerting/action-types/email.asciidoc @@ -1,11 +1,11 @@ [role="xpack"] [[email-action-type]] -=== Email action +=== Email connector and action ++++ Email ++++ -The email action type uses the SMTP protocol to send mail message, using an integration of https://nodemailer.com/[Nodemailer]. Email message text is sent as both plain text and html text. +The email connector uses the SMTP protocol to send mail messages, using an integration of https://nodemailer.com/[Nodemailer]. Email message text is sent as both plain text and html text. NOTE: For emails to have a footer with a link back to {kib}, set the <> configuration setting. @@ -26,12 +26,12 @@ Password:: Password for login type authentication. [float] [[Preconfigured-email-configuration]] -==== Preconfigured action type +==== Preconfigured connector type [source,text] -- my-email: - name: preconfigured-email-action-type + name: preconfigured-email-connector-type actionTypeId: .email config: from: testsender@test.com @@ -43,7 +43,7 @@ Password:: Password for login type authentication. password: passwordkeystorevalue -- -Config defines information for the action type. +Config defines information for the connector type. `service`:: The name of a https://nodemailer.com/smtp/well-known/[well-known email service provider]. If `service` is provided, `host`, `port`, and `secure` properties are ignored. For more information on the `gmail` service value, see the https://nodemailer.com/usage/using-gmail/[Nodemailer Gmail documentation]. `from`:: An email address that corresponds to *Sender*. @@ -52,7 +52,7 @@ Config defines information for the action type. `secure`:: A boolean that corresponds to *Secure*. `hasAuth`:: A boolean that corresponds to *Requires authentication*. If `true`, this connector will require values for `user` and `password` inside the secrets configuration. Defaults to `true`. -Secrets defines sensitive information for the action type. +Secrets defines sensitive information for the connector type. `user`:: A string that corresponds to *Username*. Required if `hasAuth` is set to `true`. `password`:: A string that corresponds to *Password*. Should be stored in the <>. Required if `hasAuth` is set to `true`. @@ -71,24 +71,22 @@ Message:: The message text of the email. Markdown format is supported. [[configuring-email]] ==== Configuring email accounts for well-known services -The email action can send email using many popular SMTP email services. +The email connector can send email using many popular SMTP email services. -You configure the email action to send emails using the connector form. -For more information about configuring the email connector to work with different email -systems, refer to: +For more information about configuring the email connector to work with different email systems, refer to: * <> * <> * <> * <> -For other email servers, you can check the list of well-known services that Nodemailer supports in the JSON file https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json[well-known/services.json]. The properties of the objects in those files — `host`, `port`, and `secure` — correspond to the same email action configuration properties. A missing `secure` property in the "well-known/services.json" file is considered `false`. Typically, `port: 465` uses `secure: true`, and `port: 25` and `port: 587` use `secure: false`. +For other email servers, you can check the list of well-known services that Nodemailer supports in the JSON file https://github.com/nodemailer/nodemailer/blob/master/lib/well-known/services.json[well-known/services.json]. The properties of the objects in those files — `host`, `port`, and `secure` — correspond to the same email connector configuration properties. A missing `secure` property in the "well-known/services.json" file is considered `false`. Typically, `port: 465` uses `secure: true`, and `port: 25` and `port: 587` use `secure: false`. [float] [[gmail]] ===== Sending email from Gmail -Use the following email account settings to send email from the +Use the following email connector configuration to send email from the https://mail.google.com[Gmail] SMTP service: [source,text] @@ -108,7 +106,7 @@ to configure Gmail to https://support.google.com/accounts/answer/6010255?hl=en[a less secure apps to access your account]. If two-step verification is enabled for your account, you must generate and use -a unique App Password to send email from {watcher}. See +a unique App Password to send email from {kib}. See https://support.google.com/accounts/answer/185833?hl=en[Sign in using App Passwords] for more information. @@ -116,7 +114,7 @@ for more information. [[outlook]] ===== Sending email from Outlook.com -Use the following email account settings to send email action from the +Use the following email connector configuration to send email from the https://www.outlook.com/[Outlook.com] SMTP service: [source,text] @@ -130,8 +128,8 @@ secrets: password: -------------------------------------------------- -When sending emails, you must provide a from address, either as the default -in your account configuration or as part of the email action in the watch. +When sending emails, you must provide a `from` address, either as the default +in your connector configuration or as part of the email action in the rule. NOTE: You must use a unique App Password if two-step verification is enabled. See http://windows.microsoft.com/en-us/windows/app-passwords-two-step-verification[App @@ -141,7 +139,7 @@ NOTE: You must use a unique App Password if two-step verification is enabled. [[amazon-ses]] ===== Sending email from Amazon SES (Simple Email Service) -Use the following email account settings to send email from the +Use the following email connector configuration to send email from the http://aws.amazon.com/ses[Amazon Simple Email Service] (SES) SMTP service: [source,text] @@ -168,7 +166,7 @@ NOTE: You must use your Amazon SES SMTP credentials to send email through [[exchange]] ===== Sending email from Microsoft Exchange -Use the following email account settings to send email action from Microsoft +Use the following email connector configuration to send email from Microsoft Exchange: [source,text] diff --git a/docs/user/alerting/action-types/index.asciidoc b/docs/user/alerting/action-types/index.asciidoc index a57048243d757..80226e737e9c0 100644 --- a/docs/user/alerting/action-types/index.asciidoc +++ b/docs/user/alerting/action-types/index.asciidoc @@ -1,11 +1,11 @@ [role="xpack"] [[index-action-type]] -=== Index action +=== Index connector and action ++++ Index ++++ -The index action type will index a document into {es}. See also the {ref}/indices-create-index.html[create index API]. +The index connector will index a document into {es}. See also the {ref}/indices-create-index.html[create index API]. [float] [[index-connector-configuration]] @@ -20,12 +20,12 @@ Execution time field:: This field will be automatically set to the time the ale [float] [[Preconfigured-index-configuration]] -==== Preconfigured action type +==== Preconfigured connector type [source,text] -- my-index: - name: action-type-index + name: preconfigured-index-connector-type actionTypeId: .index config: index: .kibana @@ -33,7 +33,7 @@ Execution time field:: This field will be automatically set to the time the ale executionTimeField: somedate -- -Config defines information for the action type. +Config defines information for the connector type. `index`:: A string that corresponds to *Index*. `refresh`:: A boolean that corresponds to *Refresh*. Defaults to `false`. @@ -51,19 +51,19 @@ Document:: The document to index in JSON format. [[index-action-example]] ==== Example -Example of the index document for Index Threshold alert: +Example of the index document for Index Threshold rule: [source,text] -------------------------------------------------- { + "rule_id": "{{ruleId}}", + "rule_name": "{{ruleName}}", "alert_id": "{{alertId}}", - "alert_name": "{{alertName}}", - "alert_instance_id": "{{alertInstanceId}}", "context_message": "{{context.message}}" } -------------------------------------------------- -Example of create test index using the API. +Example of creating a test index using the API. [source,text] -------------------------------------------------- @@ -74,9 +74,9 @@ PUT test }, "mappings" : { "properties" : { + "rule_id" : { "type" : "text" }, + "rule_name" : { "type" : "text" }, "alert_id" : { "type" : "text" }, - "alert_name" : { "type" : "text" }, - "alert_instance_id" : { "type" : "text" }, "context_message": { "type" : "text" } } } diff --git a/docs/user/alerting/action-types/jira.asciidoc b/docs/user/alerting/action-types/jira.asciidoc index a1941b4b30283..7b4dc69bb639a 100644 --- a/docs/user/alerting/action-types/jira.asciidoc +++ b/docs/user/alerting/action-types/jira.asciidoc @@ -1,11 +1,11 @@ [role="xpack"] [[jira-action-type]] -=== Jira action +=== Jira connector and action ++++ Jira ++++ -The Jira action type uses the https://developer.atlassian.com/cloud/jira/platform/rest/v2/[REST API v2] to create Jira issues. +The Jira connector uses the https://developer.atlassian.com/cloud/jira/platform/rest/v2/[REST API v2] to create Jira issues. [float] [[jira-connector-configuration]] @@ -21,12 +21,12 @@ API token (or password):: Jira API authentication token (or password) for HTTP [float] [[Preconfigured-jira-configuration]] -==== Preconfigured action type +==== Preconfigured connector type [source,text] -- my-jira: - name: preconfigured-jira-action-type + name: preconfigured-jira-connector-type actionTypeId: .jira config: apiUrl: https://elastic.atlassian.net @@ -36,12 +36,12 @@ API token (or password):: Jira API authentication token (or password) for HTTP apiToken: tokenkeystorevalue -- -Config defines information for the action type. +Config defines information for the connector type. `apiUrl`:: An address that corresponds to *URL*. `projectKey`:: A key that corresponds to *Project Key*. -Secrets defines sensitive information for the action type. +Secrets defines sensitive information for the connector type. `email`:: A string that corresponds to *Email*. `apiToken`:: A string that corresponds to *API Token*. Should be stored in the <>. diff --git a/docs/user/alerting/action-types/pagerduty.asciidoc b/docs/user/alerting/action-types/pagerduty.asciidoc index f74b5773b3719..c32e6c8a6635f 100644 --- a/docs/user/alerting/action-types/pagerduty.asciidoc +++ b/docs/user/alerting/action-types/pagerduty.asciidoc @@ -1,11 +1,11 @@ [role="xpack"] [[pagerduty-action-type]] -=== PagerDuty action +=== PagerDuty connector and action ++++ PagerDuty ++++ -The PagerDuty action type uses the https://v2.developer.pagerduty.com/docs/events-api-v2[v2 Events API] to trigger, acknowledge, and resolve PagerDuty alerts. +The PagerDuty connector uses the https://v2.developer.pagerduty.com/docs/events-api-v2[v2 Events API] to trigger, acknowledge, and resolve PagerDuty alerts. [float] [[pagerduty-connector-configuration]] @@ -19,12 +19,12 @@ Integration Key:: A 32 character PagerDuty Integration Key for an integration [float] [[Preconfigured-pagerduty-configuration]] -==== Preconfigured action type +==== Preconfigured connector type [source,text] -- my-pagerduty: - name: preconfigured-pagerduty-action-type + name: preconfigured-pagerduty-connector-type actionTypeId: .pagerduty config: apiUrl: https://test.host @@ -32,11 +32,11 @@ Integration Key:: A 32 character PagerDuty Integration Key for an integration routingKey: testroutingkey -- -Config defines information for the action type. +Config defines information for the connector type. `apiURL`:: A URL string that corresponds to *API URL*. -Secrets defines sensitive information for the action type. +Secrets defines sensitive information for the connector type. `routingKey`:: A string that corresponds to *Integration Key*. @@ -62,11 +62,11 @@ For more details on these properties, see https://v2.developer.pagerduty.com/v2/ [[pagerduty-benefits]] ==== Configure PagerDuty -By integrating PagerDuty with alerts, you can: +By integrating PagerDuty with rules, you can: -* Route your alerts to the right PagerDuty responder within your team, based on your structure, escalation policies, and workflows. -* Automatically generate incidents of different types and severity based on each alert’s context. -* Tailor the incident data to match your needs by easily passing the alerting context from Kibana to PagerDuty. +* Route your rules to the right PagerDuty responder within your team, based on your structure, escalation policies, and workflows. +* Automatically generate incidents of different types and severity based on each rule’s context. +* Tailor the incident data to match your needs by easily passing the rule context from Kibana to PagerDuty. [float] [[pagerduty-support]] @@ -110,10 +110,9 @@ image::user/alerting/images/pagerduty-integration.png[PagerDuty Integrations tab . Create a PagerDuty Connector in Kibana. You can: + -* Create a connector as part of creating an alert by selecting PagerDuty in the *Actions* -section of the alert configuration and selecting *Add new*. -* Alternatively, create a connector. To create a connector, open the main menu, click *Stack Management* > -Alerts and Actions*, select *Connectors*, click *Create connector*, then select the PagerDuty option. +* Create a connector as part of creating an rule by selecting PagerDuty in the *Actions* +section of the rule configuration and selecting *Add new*. +* Alternatively, create a connector. To create a connector, open the main menu, click *Stack Management > Rules and Connectors*, select *Connectors*, click *Create connector*, then select the PagerDuty option. . Configure the connector by giving it a name and entering the Integration Key, optionally entering a custom API URL. + @@ -122,15 +121,15 @@ See <> for how to obtain the endpoint and . Save the Connector. -. To create an alert, open the main menu, then click *Stack Management > Alerts and Actions* or the application of your choice. +. To create a rule, open the main menu, then click *Stack Management > Rules and Connectors* or the application of your choice. . Set up an action using your PagerDuty connector, by determining: + * The action’s type: Trigger, Resolve, or Acknowledge. * The event’s severity: Info, warning, error, or critical. -* An array of different fields, including the timestamp, group, class, component, and your dedup key. By default, the dedup is configured to create a new PagerDuty incident for each alert instance and reuse the incident when a recovered alert instance reactivates. -Depending on your custom needs, assign them variables from the alerting context. -To see the available context variables, click on the *Add alert variable* icon next +* An array of different fields, including the timestamp, group, class, component, and your dedup key. By default, the dedup is configured to create a new PagerDuty incident for each alert and reuse the incident when a recovered alert reactivates. +Depending on your custom needs, assign them variables from the rule context. +To see the available context variables, click on the *Add variable* icon next to each corresponding field. For more details on these parameters, see the <> and the PagerDuty https://v2.developer.pagerduty.com/v2/docs/send-an-event-events-api-v2[API v2 documentation]. diff --git a/docs/user/alerting/action-types/pre-configured-connectors.asciidoc b/docs/user/alerting/action-types/pre-configured-connectors.asciidoc index a748a06398ef3..ee8a28a864824 100644 --- a/docs/user/alerting/action-types/pre-configured-connectors.asciidoc +++ b/docs/user/alerting/action-types/pre-configured-connectors.asciidoc @@ -1,24 +1,20 @@ [role="xpack"] -[[pre-configured-action-types-and-connectors]] +[[pre-configured-connectors]] -=== Preconfigured connectors and action types +=== Preconfigured connectors -You can preconfigure a connector or action type to have all the information it needs prior to startup -by adding it to the `kibana.yml` file. +You can preconfigure a connector to have all the information it needs prior to startup by adding it to the `kibana.yml` file. -Preconfigured connectors offer the following capabilities: +Preconfigured connectors offer the following benefits: - Require no setup. Configuration and credentials needed to execute an action are predefined, including the connector name and ID. - Appear in all spaces because they are not saved objects. - Cannot be edited or deleted. -A preconfigured action type has only preconfigured connectors. Preconfigured -connectors can belong to either the preconfigured action type or to the regular action type. - [float] [[preconfigured-connector-example]] -==== Preconfigured connectors +==== Preconfigured connectors example This example shows a valid configuration for two out-of-the box connectors: <> and <>. @@ -44,78 +40,27 @@ two out-of-the box connectors: <> and < The key is the action connector identifier, `my-slack1` in this example. +<1> The key is the connector identifier, `my-slack1` in this example. <2> `actionTypeId` is the action type identifier. <3> `name` is the name of the preconfigured connector. -<4> `config` is the action type specific to the configuration. -<5> `secrets` is sensitive configuration, such as username, password, and keys. +<4> `config` is the configuration specific to the connector type. +<5> `secrets` is the sensitive configuration, such as username, password, and keys, specific to the connector type. [NOTE] ============================================== Sensitive properties, such as passwords, can also be stored in the <>. ============================================== -//// [float] [[managing-pre-configured-connectors]] ==== View preconfigured connectors -//// -When you open the main menu, click *Stack Management > Alerts and Actions*. Preconfigured connectors -appear on the <>, -regardless of which space you are in. -They are tagged as “preconfigured”, and you cannot delete them. +When you open the main menu, click *Stack Management > Rules and Connectors*. Preconfigured connectors appear on the <>, regardless of which space you are in. They are tagged as “preconfigured”, and you cannot delete them. [role="screenshot"] -image::images/pre-configured-connectors-managing.png[Connectors managing tab with pre-cofigured] +image::images/pre-configured-connectors-managing.png[Connectors managing tab with pre-configured] -Clicking a preconfigured connector shows the description, but not the configuration. -A message indicates that this is a preconfigured connector. +Clicking a preconfigured connector shows the description, but not the configuration. A message indicates that this is a preconfigured connector. [role="screenshot"] image::images/pre-configured-connectors-view-screen.png[Pre-configured connector view details] - -The connector details preview is disabled for preconfigured connectors -of a preconfigured action type. - -[role="screenshot"] -image::images/pre-configured-action-type-managing.png[Connectors managing tab with pre-cofigured] - -[float] -[[preconfigured-action-type-example]] -==== Preconfigured action type - -This example shows a preconfigured action type with one out-of-the box connector. - -```js - xpack.actions.enabledActionTypes: ['.slack', '.email', '.index'] <1> - xpack.actions.preconfigured: <2> - my-server-log: - actionTypeId: .server-log - name: 'Server log #xyz' -``` - -<1> `enabledActionTypes` prevents the preconfigured action type from creating and deleting connectors. For more details, check <>. -<2> `preconfigured` is the setting for defining the list of available connectors for the preconfigured action type. - -[[managing-pre-configured-action-types]] -To attach a preconfigured action to an alert: - -. Open the main menu, click *Stack Management > Alerts and Actions*, then open the *Connectors* tab. - -. Click *Create connector.* - -. In the list of available action types, select the preconfigured action type you want. -+ -[role="screenshot"] -image::images/pre-configured-action-type-select-type.png[Pre-configured connector create menu] - -. In *Create alert*, open the connector dropdown, and then select the preconfigured -connector. -+ -The `preconfigured` label distinguishes it from a space-aware connector. -+ -[role="screenshot"] -image::images/alert-pre-configured-connectors-dropdown.png[Dropdown list with pre-cofigured connectors] - -. Click *Add action*. diff --git a/docs/user/alerting/action-types/resilient.asciidoc b/docs/user/alerting/action-types/resilient.asciidoc index 296156875ceb6..862af0e526337 100644 --- a/docs/user/alerting/action-types/resilient.asciidoc +++ b/docs/user/alerting/action-types/resilient.asciidoc @@ -1,11 +1,11 @@ [role="xpack"] [[resilient-action-type]] -=== IBM Resilient action +=== IBM Resilient connector and action ++++ IBM Resilient ++++ -The IBM Resilient action type uses the https://developer.ibm.com/security/resilient/rest/[RESILIENT REST v2] to create IBM Resilient incidents. +The IBM Resilient connector uses the https://developer.ibm.com/security/resilient/rest/[RESILIENT REST v2] to create IBM Resilient incidents. [float] [[resilient-connector-configuration]] @@ -21,12 +21,12 @@ API key secret:: The authentication key secret for HTTP Basic authentication. [float] [[Preconfigured-resilient-configuration]] -==== Preconfigured action type +==== Preconfigured connector type [source,text] -- my-resilient: - name: preconfigured-resilient-action-type + name: preconfigured-resilient-connector-type actionTypeId: .resilient config: apiUrl: https://elastic.resilient.net @@ -36,12 +36,12 @@ API key secret:: The authentication key secret for HTTP Basic authentication. apiKeySecret: tokenkeystorevalue -- -Config defines information for the action type. +Config defines information for the connector type. `apiUrl`:: An address that corresponds to *URL*. `orgId`:: An ID that corresponds to *Organization ID*. -Secrets defines sensitive information for the action type. +Secrets defines sensitive information for the connector type. `apiKeyId`:: A string that corresponds to *API key ID*. `apiKeySecret`:: A string that corresponds to *API Key secret*. Should be stored in the <>. diff --git a/docs/user/alerting/action-types/server-log.asciidoc b/docs/user/alerting/action-types/server-log.asciidoc index 7849a70a239c3..e497ed3a4467a 100644 --- a/docs/user/alerting/action-types/server-log.asciidoc +++ b/docs/user/alerting/action-types/server-log.asciidoc @@ -1,11 +1,11 @@ [role="xpack"] [[server-log-action-type]] -=== Server log action +=== Server log connector and action ++++ Server log ++++ -This action type writes an entry to the {kib} server log. +This connector writes an entry to the {kib} server log. [float] [[server-log-connector-configuration]] @@ -17,12 +17,12 @@ Name:: The name of the connector. The name is used to identify a connector [float] [[Preconfigured-server-log-configuration]] -==== Preconfigured action type +==== Preconfigured connector type [source,text] -- my-server-log: - name: test + name: preconfigured-server-log-connector-type actionTypeId: .server-log -- diff --git a/docs/user/alerting/action-types/servicenow.asciidoc b/docs/user/alerting/action-types/servicenow.asciidoc index f002c39416f1a..35d50f1bfeb72 100644 --- a/docs/user/alerting/action-types/servicenow.asciidoc +++ b/docs/user/alerting/action-types/servicenow.asciidoc @@ -1,11 +1,11 @@ [role="xpack"] [[servicenow-action-type]] -=== ServiceNow action +=== ServiceNow connector and action ++++ ServiceNow ++++ -The ServiceNow action type uses the https://developer.servicenow.com/app.do#!/rest_api_doc?v=orlando&id=c_TableAPI[V2 Table API] to create ServiceNow incidents. +The ServiceNow connector uses the https://developer.servicenow.com/app.do#!/rest_api_doc?v=orlando&id=c_TableAPI[V2 Table API] to create ServiceNow incidents. [float] [[servicenow-connector-configuration]] @@ -20,12 +20,12 @@ Password:: Password for HTTP Basic authentication. [float] [[Preconfigured-servicenow-configuration]] -==== Preconfigured action type +==== Preconfigured connector type [source,text] -- my-servicenow: - name: preconfigured-servicenow-action-type + name: preconfigured-servicenow-connector-type actionTypeId: .servicenow config: apiUrl: https://dev94428.service-now.com/ @@ -34,11 +34,11 @@ Password:: Password for HTTP Basic authentication. password: passwordkeystorevalue -- -Config defines information for the action type. +Config defines information for the connector type. `apiUrl`:: An address that corresponds to *URL*. -Secrets defines sensitive information for the action type. +Secrets defines sensitive information for the connector type. `username`:: A string that corresponds to *Username*. `password`:: A string that corresponds to *Password*. Should be stored in the <>. diff --git a/docs/user/alerting/action-types/slack.asciidoc b/docs/user/alerting/action-types/slack.asciidoc index 6f7d1b3e11d31..3ef369e2a4e4a 100644 --- a/docs/user/alerting/action-types/slack.asciidoc +++ b/docs/user/alerting/action-types/slack.asciidoc @@ -1,11 +1,11 @@ [role="xpack"] [[slack-action-type]] -=== Slack action +=== Slack connector and action ++++ Slack ++++ -The Slack action type uses https://api.slack.com/incoming-webhooks[Slack Incoming Webhooks]. +The Slack connector uses https://api.slack.com/incoming-webhooks[Slack Incoming Webhooks]. [float] [[slack-connector-configuration]] @@ -18,18 +18,18 @@ Webhook URL:: The URL of the incoming webhook. See https://api.slack.com/messa [float] [[Preconfigured-slack-configuration]] -==== Preconfigured action type +==== Preconfigured connector type [source,text] -- my-slack: - name: preconfigured-slack-action-type + name: preconfigured-slack-connector-type actionTypeId: .slack secrets: webhookUrl: 'https://hooks.slack.com/services/abcd/efgh/ijklmnopqrstuvwxyz' -- -Secrets defines sensitive information for the action type. +Secrets defines sensitive information for the connector type. `webhookUrl`:: A string that corresponds to *Webhook URL*. diff --git a/docs/user/alerting/action-types/teams.asciidoc b/docs/user/alerting/action-types/teams.asciidoc index 294b5474e390a..1a0e52141ee9c 100644 --- a/docs/user/alerting/action-types/teams.asciidoc +++ b/docs/user/alerting/action-types/teams.asciidoc @@ -1,11 +1,11 @@ [role="xpack"] [[teams-action-type]] -=== Microsoft Teams action +=== Microsoft Teams connector and action ++++ Microsoft Teams ++++ -The Microsoft Teams action type uses https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook[Incoming Webhooks]. +The Microsoft Teams connector uses https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook[Incoming Webhooks]. [float] [[teams-connector-configuration]] @@ -18,18 +18,18 @@ Webhook URL:: The URL of the incoming webhook. See https://docs.microsoft.com/ [float] [[Preconfigured-teams-configuration]] -==== Preconfigured action type +==== Preconfigured connector type [source,text] -- my-teams: - name: preconfigured-teams-action-type + name: preconfigured-teams-connector-type actionTypeId: .teams secrets: webhookUrl: 'https://outlook.office.com/webhook/abcd@0123456/IncomingWebhook/abcdefgh/ijklmnopqrstuvwxyz' -- -Secrets defines sensitive information for the action type. +Secrets defines sensitive information for the connector type. `webhookUrl`:: A string that corresponds to *Webhook URL*. diff --git a/docs/user/alerting/action-types/webhook.asciidoc b/docs/user/alerting/action-types/webhook.asciidoc index 381d6e72bf9c0..01ddfee288fc8 100644 --- a/docs/user/alerting/action-types/webhook.asciidoc +++ b/docs/user/alerting/action-types/webhook.asciidoc @@ -1,11 +1,11 @@ [role="xpack"] [[webhook-action-type]] -=== Webhook action +=== Webhook connector and action ++++ Webhook ++++ -The Webhook action type uses https://github.com/axios/axios[axios] to send a POST or PUT request to a web service. +The Webhook connector uses https://github.com/axios/axios[axios] to send a POST or PUT request to a web service. [float] [[webhook-connector-configuration]] @@ -23,12 +23,12 @@ Password:: Password for HTTP basic authentication. [float] [[Preconfigured-webhook-configuration]] -==== Preconfigured action type +==== Preconfigured connector type [source,text] -- my-webhook: - name: preconfigured-webhook-action-type + name: preconfigured-webhook-connector-type actionTypeId: .webhook config: url: https://test.host @@ -40,14 +40,14 @@ Password:: Password for HTTP basic authentication. password: passwordkeystorevalue -- -Config defines information for the action type. +Config defines information for the connector type. `url`:: A URL string that corresponds to *URL*. `method`:: A string that corresponds to *Method*. `headers`:: A record that corresponds to *Headers*. `hasAuth`:: A boolean that corresponds to *Requires authentication*. If `true`, this connector will require values for `user` and `password` inside the secrets configuration. Defaults to `true`. -Secrets defines sensitive information for the action type. +Secrets defines sensitive information for the connector type. `user`:: A string that corresponds to *User*. Required if `hasAuth` is set to `true`. `password`:: A string that corresponds to *Password*. Should be stored in the <>. Required if `hasAuth` is set to `true`. diff --git a/docs/user/alerting/alert-types.asciidoc b/docs/user/alerting/alert-types.asciidoc deleted file mode 100644 index af193cf2f037f..0000000000000 --- a/docs/user/alerting/alert-types.asciidoc +++ /dev/null @@ -1,42 +0,0 @@ -[role="xpack"] -[[alert-types]] -== Alerts - -Kibana provides two types of alerts: - -* Stack alerts, which are built into {kib} -* Domain-specific alerts, which are registered by {kib} apps. - -[float] -==== Standard stack alerts - -{kib} provides two stack alerts: - -* <> -* <> - -Users require the `all` privilege to access the *Stack Alerts* feature and create and edit alerts. -See <> for more information. - -[float] -==== Domain-specific alerts - -For domain-specific alerts, refer to the documentation for that app. -{kib} supports these alerts: - -* {observability-guide}/create-alerts.html[Observability alerts] -* {security-guide}/prebuilt-rules.html[Security alerts] -* <> -* {ml-docs}/ml-configuring-alerts.html[{ml-cap} alerts] beta:[] - -[NOTE] -============================================== -Some alert types are subscription features, while others are free features. -For a comparison of the Elastic subscription levels, -see {subscriptions}[the subscription page]. -============================================== - - -include::stack-alerts/index-threshold.asciidoc[] -include::stack-alerts/es-query.asciidoc[] -include::maps-alerts/geo-alert-types.asciidoc[] diff --git a/docs/user/alerting/alerting-getting-started.asciidoc b/docs/user/alerting/alerting-getting-started.asciidoc index 7eae7d9a3b6e4..2c8985075398e 100644 --- a/docs/user/alerting/alerting-getting-started.asciidoc +++ b/docs/user/alerting/alerting-getting-started.asciidoc @@ -1,13 +1,13 @@ [role="xpack"] [[alerting-getting-started]] -= Alerting and Actions += Alerting -- -Alerting allows you to detect complex conditions within different {kib} apps and trigger actions when those conditions are met. Alerting is integrated with {observability-guide}/create-alerts.html[*Observability*], {security-guide}/prebuilt-rules.html[*Security*], <> and {ml-docs}/ml-configuring-alerts.html[*{ml-app}*], can be centrally managed from the <> UI, and provides a set of built-in <> and <> (known as stack alerts) for you to use. +Alerting allows you to define *rules* to detect complex conditions within different {kib} apps and trigger actions when those conditions are met. Alerting is integrated with {observability-guide}/create-alerts.html[*Observability*], {security-guide}/prebuilt-rules.html[*Security*], <> and {ml-docs}/ml-configuring-alerts.html[*{ml-app}*], can be centrally managed from the <> UI, and provides a set of built-in <> and <> (known as stack rules) for you to use. -image::images/alerting-overview.png[Alerts and actions UI] +image::images/alerting-overview.png[Rules and Connectors UI] [IMPORTANT] ============================================== @@ -17,120 +17,119 @@ To make sure you can access alerting and actions, see the < 0.9 on each server for the two minutes (condition), checked every minute (schedule), sending a warning email message via SMTP with subject `CPU on {{server}} is high` (action). +For example, when monitoring a set of servers, a rule might check for average CPU usage > 0.9 on each server for the last two minutes (condition), checked every minute (schedule), sending a warning email message via SMTP with subject `CPU on {{server}} is high` (action). -image::images/what-is-an-alert.svg[Three components of an alert] +image::images/what-is-a-rule.svg[Three components of a rule] -The following sections each part of the alert is described in more detail. +The following sections describe each part of the rule in more detail. [float] [[alerting-concepts-conditions]] ==== Conditions -Under the hood, {kib} alerts detect conditions by running javascript function on the {kib} server, which gives it flexibility to support a wide range of detections, anything from the results of a simple {es} query to heavy computations involving data from multiple sources or external systems. +Under the hood, {kib} rules detect conditions by running a javascript function on the {kib} server, which gives it the flexibility to support a wide range of conditions, anything from the results of a simple {es} query to heavy computations involving data from multiple sources or external systems. -These detections are packaged and exposed as *alert types*. An alert type hides the underlying details of the detection, and exposes a set of parameters -to control the details of the conditions to detect. +These conditions are packaged and exposed as *rule types*. A rule type hides the underlying details of the condition, and exposes a set of parameters +to control the details of the conditions to detect. -For example, an <> lets you specify the index to query, an aggregation field, and a time window, but the details of the underlying {es} query are hidden. +For example, an <> lets you specify the index to query, an aggregation field, and a time window, but the details of the underlying {es} query are hidden. -See <> for the types of alerts provided by {kib} and how they express their conditions. +See <> for the types of rules provided by {kib} and how they express their conditions. [float] [[alerting-concepts-scheduling]] ==== Schedule -Alert schedules are defined as an interval between subsequent checks, and can range from a few seconds to months. +Rule schedules are defined as an interval between subsequent checks, and can range from a few seconds to months. [IMPORTANT] ============================================== -The intervals of alert checks in {kib} are approximate, their timing of their execution is affected by factors such as the frequency at which tasks are claimed and the task load on the system. See <> for more information. +The intervals of rule checks in {kib} are approximate. The timing of their execution is affected by factors such as the frequency at which tasks are claimed and the task load on the system. See <> for more information. ============================================== [float] [[alerting-concepts-actions]] ==== Actions -Actions are invocations of {kib} services or integrations with third-party systems, that run as background tasks on the {kib} server when alert conditions are met. +Actions are invocations of connectors, which allow interaction with {kib} services or integrations with third-party systems. Actions run as background tasks on the {kib} server when rule conditions are met. -When defining actions in an alert, you specify: +When defining actions in a rule, you specify: -* the *action type*: the type of service or integration to use -* the connection for that type by referencing a <> -* a mapping of alert values to properties exposed for that type of action +* the *connector type*: the type of service or integration to use +* the connection for that type by referencing a <> +* a mapping of rule values to properties exposed for that type of action -The result is a template: all the parameters needed to invoke a service are supplied except for specific values that are only known at the time the alert condition is detected. +The result is a template: all the parameters needed to invoke a service are supplied except for specific values that are only known at the time the rule condition is detected. -In the server monitoring example, the `email` action type is used, and `server` is mapped to the body of the email, using the template string `CPU on {{server}} is high`. +In the server monitoring example, the `email` connector type is used, and `server` is mapped to the body of the email, using the template string `CPU on {{server}} is high`. -When the alert detects the condition, it creates an <> containing the details of the condition, renders the template with these details such as server name, and executes the action on the {kib} server by invoking the `email` action type. +When the rule detects the condition, it creates an <> containing the details of the condition, renders the template with these details such as server name, and executes the action on the {kib} server by invoking the `email` connector type. image::images/what-is-an-action.svg[Actions are like templates that are rendered when an alert detects a condition] -See <> for details on the types of actions provided by {kib}. +See <> for details on the types of connectors provided by {kib}. [float] [[alerting-concepts-alert-instances]] -=== Alert instances +=== Alerts -When checking for a condition, an alert might identify multiple occurrences of the condition. {kib} tracks each of these *alert instances* separately and takes action per instance. +When checking for a condition, a rule might identify multiple occurrences of the condition. {kib} tracks each of these *alerts* separately and takes an action per alert. -Using the server monitoring example, each server with average CPU > 0.9 is tracked as an alert instance. This means a separate email is sent for each server that exceeds the threshold. +Using the server monitoring example, each server with average CPU > 0.9 is tracked as an alert. This means a separate email is sent for each server that exceeds the threshold. -image::images/alert-instances.svg[{kib} tracks each detected condition as an alert instance and takes action on each instance] +image::images/alerts.svg[{kib} tracks each detected condition as an alert and takes action on each alert] [float] [[alerting-concepts-suppressing-duplicate-notifications]] === Suppressing duplicate notifications -Since actions are taken per instance, alerts can end up generating a large number of actions. Take the following example where an alert is monitoring three servers every minute for CPU usage > 0.9: +Since actions are executed per alert, a rule can end up generating a large number of actions. Take the following example where a rule is monitoring three servers every minute for CPU usage > 0.9: -* Minute 1: server X123 > 0.9. *One email* is sent for server X123. -* Minute 2: X123 and Y456 > 0.9. *Two emails* are sent, on for X123 and one for Y456. +* Minute 1: server X123 > 0.9. *One email* is sent for server X123. +* Minute 2: X123 and Y456 > 0.9. *Two emails* are sent, one for X123 and one for Y456. * Minute 3: X123, Y456, Z789 > 0.9. *Three emails* are sent, one for each of X123, Y456, Z789. -In the above example, three emails are sent for server X123 in the span of 3 minutes for the same condition. Often it's desirable to suppress frequent re-notification. Operations like muting and re-notification throttling can be applied at the instance level. If we set the alert re-notify interval to 5 minutes, we reduce noise by only getting emails for new servers that exceed the threshold: +In the above example, three emails are sent for server X123 in the span of 3 minutes for the same rule. Often it's desirable to suppress frequent re-notification. Operations like muting and throttling can be applied at the alert level. If we set the rule re-notify interval to 5 minutes, we reduce noise by only getting emails for new servers that exceed the threshold: * Minute 1: server X123 > 0.9. *One email* is sent for server X123. -* Minute 2: X123 and Y456 > 0.9. *One email* is sent for Y456 -* Minute 3: X123, Y456, Z789 > 0.9. *One email* is sent for Z789. +* Minute 2: X123 and Y456 > 0.9. *One email* is sent for Y456. +* Minute 3: X123, Y456, Z789 > 0.9. *One email* is sent for Z789. [float] [[alerting-concepts-connectors]] === Connectors -Actions often involve connecting with services inside {kib} or integrations with third-party systems. -Rather than repeatedly entering connection information and credentials for each action, {kib} simplifies action setup using *connectors*. +Actions often involve connecting with services inside {kib} or integrating with third-party systems. +Rather than repeatedly entering connection information and credentials for each action, {kib} simplifies action setup using *connectors*. -*Connectors* provide a central place to store connection information for services and integrations. For example if four alerts send email notifications via the same SMTP service, -they all reference the same SMTP connector. When the SMTP settings change they are updated once in the connector, instead of having to update four alerts. +*Connectors* provide a central place to store connection information for services and integrations. For example if four rules send email notifications via the same SMTP service, they can all reference the same SMTP connector. When the SMTP settings change, you can update them once in the connector, instead of having to update four rules. -image::images/alert-concepts-connectors.svg[Connectors provide a central place to store service connection settings] +image::images/rule-concepts-connectors.svg[Connectors provide a central place to store service connection settings] [float] === Summary -An _alert_ consists of conditions, _actions_, and a schedule. When conditions are met, _alert instances_ are created that render _actions_ and invoke them. To make action setup and update easier, actions refer to _connectors_ that centralize the information used to connect with {kib} services and third-party integrations. The following example ties these concepts together: +A *rule* consists of conditions, *actions*, and a schedule. When conditions are met, *alerts* are created that render *actions* and invoke them. To make action setup and update easier, actions use *connectors* that centralize the information used to connect with {kib} services and third-party integrations. The following example ties these concepts together: -image::images/alert-concepts-summary.svg[Alerts, actions, alert instances and connectors work together to convert detection into action] +image::images/rule-concepts-summary.svg[Rules, connectors, alerts and actions work together to convert detection into action] -. Anytime an *alert*'s conditions are met, an *alert instance* is created. This example checks for servers with average CPU > 0.9. Three servers meet the condition, so three instances are created. -. Instances create *actions* as long as they are not muted or throttled. When actions are created, the template that was setup in the alert is filled with actual values. In this example three actions are created, and the template string {{server}} is replaced with the server name for each instance. -. {kib} invokes the actions, sending them to a 3rd party *integration* like an email service. -. If the 3rd party integration has connection parameters or credentials, {kib} will fetch these from the *connector* referenced in the action. +. Anytime a *rule*'s conditions are met, an *alert* is created. This example checks for servers with average CPU > 0.9. Three servers meet the condition, so three alerts are created. +. Alerts create *actions* as long as they are not muted or throttled. When actions are created, the template that was setup in the rule is filled with actual values. In this example, three actions are created, and the template string {{server}} is replaced with the server name for each alert. +. {kib} invokes the actions, sending them to a third party *integration* like an email service. +. If the third party integration has connection parameters or credentials, {kib} will fetch these from the *connector* referenced in the action. [float] @@ -139,17 +138,17 @@ image::images/alert-concepts-summary.svg[Alerts, actions, alert instances and co {kib} alerting and <> are both used to detect conditions and can trigger actions in response, but they are completely independent alerting systems. -This section will clarify some of the important differences in the function and intent of the two systems. +This section will clarify some of the important differences in the function and intent of the two systems. Functionally, {kib} alerting differs in that: * Scheduled checks are run on {kib} instead of {es} -* {kib} <> through *alert types*, whereas watches provide low-level control over inputs, conditions, and transformations. -* {kib} alerts tracks and persists the state of each detected condition through *alert instances*. This makes it possible to mute and throttle individual instances, and detect changes in state such as resolution. -* Actions are linked to *alert instances* in {kib} alerting. Actions are fired for each occurrence of a detected condition, rather than for the entire alert. +* {kib} <> through *rule types*, whereas watches provide low-level control over inputs, conditions, and transformations. +* {kib} rules track and persist the state of each detected condition through *alerts*. This makes it possible to mute and throttle individual alerts, and detect changes in state such as resolution. +* Actions are linked to *alerts* in {kib} alerting. Actions are fired for each occurrence of a detected condition, rather than for the entire rule. -At a higher level, {kib} alerts allow rich integrations across use cases like <>, <>, <>, and <>. -Pre-packaged *alert types* simplify setup, hide the details complex domain-specific detections, while providing a consistent interface across {kib}. +At a higher level, {kib} alerting allows rich integrations across use cases like <>, <>, <>, and <>. +Pre-packaged *rule types* simplify setup and hide the details of complex, domain-specific detections, while providing a consistent interface across {kib}. [float] [[alerting-setup-prerequisites]] @@ -162,13 +161,13 @@ If you are using an *on-premises* Elastic Stack deployment: If you are using an *on-premises* Elastic Stack deployment with <>: -* You must enable Transport Layer Security (TLS) for communication <>. {kib} alerting uses <> to secure background alert checks and actions, and API keys require {ref}/configuring-tls.html#tls-http[TLS on the HTTP interface]. A proxy will not suffice. +* You must enable Transport Layer Security (TLS) for communication <>. {kib} alerting uses <> to secure background rule checks and actions, and API keys require {ref}/configuring-tls.html#tls-http[TLS on the HTTP interface]. A proxy will not suffice. [float] [[alerting-setup-production]] == Production considerations and scaling guidance -When relying on alerts and actions as mission critical services, make sure you follow the <>. +When relying on alerting and actions as mission critical services, make sure you follow the <>. See <> for more information on the scalability of {kib} alerting. @@ -187,29 +186,29 @@ To access alerting in a space, a user must have access to one of the following f * <> See <> for more information on configuring roles that provide access to these features. -Also note that a user will need +read+ privileges for the *Actions and Connectors* feature to attach actions to an alert or to edit an alert that has an action attached to it. +Also note that a user will need +read+ privileges for the *Actions and Connectors* feature to attach actions to a rule or to edit a rule that has an action attached to it. [float] [[alerting-spaces]] === Space isolation -Alerts and connectors are isolated to the {kib} space in which they were created. An alert or connector created in one space will not be visible in another. +Rules and connectors are isolated to the {kib} space in which they were created. A rule or connector created in one space will not be visible in another. [float] [[alerting-authorization]] === Authorization -Alerts, including all background detection and the actions they generate are authorized using an <> associated with the last user to edit the alert. Upon creating or modifying an alert, an API key is generated for that user, capturing a snapshot of their privileges at that moment in time. The API key is then used to run all background tasks associated with the alert including detection checks and executing actions. +Rules, including all background detection and the actions they generate are authorized using an <> associated with the last user to edit the rule. Upon creating or modifying a rule, an API key is generated for that user, capturing a snapshot of their privileges at that moment in time. The API key is then used to run all background tasks associated with the rule including detection checks and executing actions. [IMPORTANT] ============================================== -If an alert requires certain privileges to run such as index privileges, keep in mind that if a user without those privileges updates the alert, the alert will no longer function. +If a rule requires certain privileges to run, such as index privileges, keep in mind that if a user without those privileges updates the rule, the rule will no longer function. ============================================== [float] [[alerting-restricting-actions]] === Restricting actions -For security reasons you may wish to limit the extent to which {kib} can connect to external services. <> allows you to disable certain <> and allowlist the hostnames that {kib} can connect with. +For security reasons you may wish to limit the extent to which {kib} can connect to external services. <> allows you to disable certain <> and allowlist the hostnames that {kib} can connect with. -- diff --git a/docs/user/alerting/alerting-troubleshooting.asciidoc b/docs/user/alerting/alerting-troubleshooting.asciidoc index 84bbeaf126a3b..f4673d10bc248 100644 --- a/docs/user/alerting/alerting-troubleshooting.asciidoc +++ b/docs/user/alerting/alerting-troubleshooting.asciidoc @@ -10,46 +10,46 @@ If your problem isn’t described here, please review open issues in the followi Have a question? Contact us in the https://discuss.elastic.co/[discuss forum]. [float] -[[alerts-small-check-interval-run-late]] -=== Alerts with small check intervals run late +[[rules-small-check-interval-run-late]] +=== Rules with small check intervals run late *Problem*: -Alerts with a small check interval, such as every two seconds, run later than scheduled. +Rules with a small check interval, such as every two seconds, run later than scheduled. *Resolution*: -Alerts run as background tasks at a cadence defined by their *check interval*. -When an Alert *check interval* is smaller than the Task Manager <> the alert will run late. +Rules run as background tasks at a cadence defined by their *check interval*. +When a Rule *check interval* is smaller than the Task Manager <> the rule will run late. -Either tweak the <> or increase the *check interval* of the alerts in question. +Either tweak the <> or increase the *check interval* of the rules in question. For more details, see <>. [float] -[[scheduled-alerts-run-late]] -=== Alerts run late +[[scheduled-rules-run-late]] +=== Rules run late *Problem*: -Scheduled alerts run at an inconsistent cadence, often running late. +Scheduled rules run at an inconsistent cadence, often running late. -Actions run long after the status of an alert changes, sending a notification of the change too late. +Actions run long after the status of a rule changes, sending a notification of the change too late. *Solution*: -Alerts and actions run as background tasks by each {kib} instance at a default rate of ten tasks every three seconds. +Rules and actions run as background tasks by each {kib} instance at a default rate of ten tasks every three seconds. -If many alerts or actions are scheduled to run at the same time, pending tasks will queue in {es}. Each {kib} instance then polls for pending tasks at a rate of up to ten tasks at a time, at three second intervals. Because alerts and actions are backed by tasks, it is possible for pending tasks in the queue to exceed this capacity and run late. +If many rules or actions are scheduled to run at the same time, pending tasks will queue in {es}. Each {kib} instance then polls for pending tasks at a rate of up to ten tasks at a time, at three second intervals. Because rules and actions are backed by tasks, it is possible for pending tasks in the queue to exceed this capacity and run late. For details on diagnosing the underlying causes of such delays, see <>. Alerting and action tasks are identified by their type. -* Alert tasks always begin with `alerting:`. For example, the `alerting:.index-threshold` tasks back the <>. +* Alerting tasks always begin with `alerting:`. For example, the `alerting:.index-threshold` tasks back the <>. * Action tasks always begin with `actions:`. For example, the `actions:.index` tasks back the <>. -When diagnosing issues related to Alerting, focus on the thats that begin with `alerting:` and `actions:`. +When diagnosing issues related to Alerting, focus on the tasks that begin with `alerting:` and `actions:`. For more details on monitoring and diagnosing task execution in Task Manager, see <>. diff --git a/docs/user/alerting/defining-alerts.asciidoc b/docs/user/alerting/defining-alerts.asciidoc deleted file mode 100644 index 8f1a0f06f75ae..0000000000000 --- a/docs/user/alerting/defining-alerts.asciidoc +++ /dev/null @@ -1,115 +0,0 @@ -[role="xpack"] -[[defining-alerts]] -== Defining alerts - -{kib} alerts can be created in a variety of apps including <>, <>, <>, <>, <> and from <> UI. While alerting details may differ from app to app, they share a common interface for defining and configuring alerts that this section describes in more detail. - -[float] -=== Create an alert - -When you create an alert, you must define the alert details, conditions, and actions. - -. <> -. <> -. <> - -image::images/alert-flyout-sections.png[The three sections of an alert definition] - -[float] -[[defining-alerts-general-details]] -=== General alert details - -All alerts share the following four properties. - -[role="screenshot"] -image::images/alert-flyout-general-details.png[alt='All alerts have name, tags, check every, and notify properties in common'] - -Name:: The name of the alert. While this name does not have to be unique, the name can be referenced in actions and also appears in the searchable alert listing in the management UI. A distinctive name can help identify and find an alert. -Tags:: A list of tag names that can be applied to an alert. Tags can help you organize and find alerts, because tags appear in the alert listing in the management UI which is searchable by tag. -Check every:: This value determines how frequently the alert conditions below are checked. Note that the timing of background alert checks are not guaranteed, particularly for intervals of less than 10 seconds. See <> for more information. -Notify:: This value limits how often actions are repeated when an alert instance remains active across alert checks. See <> for more information. + -- **Only on status change**: Actions are not repeated when an alert instance remains active across checks. Actions run only when the alert status changes. -- **Every time alert is active**: Actions are repeated when an alert instance remains active across checks. -- **On a custom action interval**: Actions are suppressed for the throttle interval, but repeat when an alert instance remains active across checks for a duration longer than the throttle interval. - - -[float] -[[defining-alerts-type-conditions]] -=== Alert type and conditions - -Depending upon the {kib} app and context, you may be prompted to choose the type of alert you wish to create. Some apps will pre-select the type of alert for you. - -[role="screenshot"] -image::images/alert-flyout-alert-type-selection.png[Choosing the type of alert to create] - -Each alert type provides its own way of defining the conditions to detect, but an expression formed by a series of clauses is a common pattern. Each clause has a UI control that allows you to define the clause. For example, in an index threshold alert the `WHEN` clause allows you to select an aggregation operation to apply to a numeric field. - -[role="screenshot"] -image::images/alert-flyout-alert-conditions.png[UI for defining alert conditions on an index threshold alert] - -[float] -[[defining-alerts-actions-details]] -=== Action type and action details - -To add an action to an alert, you first select the type of action: - -[role="screenshot"] -image::images/alert-flyout-action-type-selection.png[UI for selecting an action type] - -When an alert instance matches a condition, the alert is marked as _Active_ and assigned an action group. The actions in that group are triggered. -When the condition is no longer detected, the alert is assigned to the _Recovered_ action group, which triggers any actions assigned to that group. - -**Run When** allows you to assign an action to an action group. This will trigger the action in accordance with your **Notify** setting. - -Each action must specify a <> instance. If no connectors exist for that action type, click *Add action* to create one. - -Each action type exposes different properties. For example an email action allows you to set the recipients, the subject, and a message body in markdown format. See <> for details on the types of actions provided by {kib} and their properties. - -[role="screenshot"] -image::images/alert-flyout-action-details.png[UI for defining an email action] - -[float] -[[defining-alerts-actions-variables]] -==== Action variables -Using the https://mustache.github.io/[Mustache] template syntax `{{variable name}}`, you can pass alert values at the time a condition is detected to an action. You can access the list of available variables using the "add variable" button. Although available variables differ by alert type, all alert types pass the following variables: - -`alertId`:: The ID of the alert. -`alertName`:: The name of the alert. -`spaceId`:: The ID of the space for the alert. -`tags`:: The list of tags applied to the alert. -`date`:: The date the alert scheduled the action, in ISO format. -`alertInstanceId`:: The ID of the alert instance that scheduled the action. -`alertActionGroup`:: The ID of the action group of the alert instance that scheduled the action. -`alertActionSubgroup`:: The action subgroup of the alert instance that scheduled the action. -`alertActionGroupName`:: The name of the action group of the alert instance that scheduled the action. -`kibanaBaseUrl`:: The configured <>. If not configured, this will be empty. - -[role="screenshot"] -image::images/alert-flyout-action-variables.png[Passing alert values to an action] - -Some cases exist where the variable values will be "escaped", when used in a context where escaping is needed: - -- For the <> connector, the `message` action configuration property escapes any characters that would be interpreted as Markdown. -- For the <> connector, the `message` action configuration property escapes any characters that would be interpreted as Slack Markdown. -- For the <> connector, the `body` action configuration property escapes any characters that are invalid in JSON string values. - -Mustache also supports "triple braces" of the form `{{{variable name}}}`, which indicates no escaping should be done at all. Care should be used when using this form, as it could end up rendering the variable content in such a way as to make the resulting parameter invalid or formatted incorrectly. - -Each alert type defines additional variables as properties of the variable `context`. For example, if an alert type defines a variable `value`, it can be used in an action parameter as `{{context.value}}`. - -For diagnostic or exploratory purposes, action variables whose values are objects, such as `context`, can be referenced directly as variables. The resulting value will be a JSON representation of the object. For example, if an action parameter includes `{{context}}`, it will expand to the JSON representation of all the variables and values provided by the alert type. - -You can attach more than one action. Clicking the "Add action" button will prompt you to select another alert type and repeat the above steps again. - -[role="screenshot"] -image::images/alert-flyout-add-action.png[You can add multiple actions on an alert] - -[NOTE] -============================================== -Actions are not required on alerts. You can run an alert without actions to understand its behavior, and then <> later. -============================================== - -[float] -=== Manage alerts - -To modify an alert after it was created, including muting or disabling it, use the <>. diff --git a/docs/user/alerting/defining-rules.asciidoc b/docs/user/alerting/defining-rules.asciidoc new file mode 100644 index 0000000000000..63839cf465e98 --- /dev/null +++ b/docs/user/alerting/defining-rules.asciidoc @@ -0,0 +1,115 @@ +[role="xpack"] +[[defining-alerts]] +== Defining rules + +{kib} alerting rules can be created in a variety of apps including <>, <>, <>, <>, <> and from the <> UI. While alerting details may differ from app to app, they share a common interface for defining and configuring rules that this section describes in more detail. + +[float] +=== Create a rule + +When you create a rule, you must define the rule details, conditions, and actions. + +. <> +. <> +. <> + +image::images/rule-flyout-sections.png[The three sections of a rule definition] + +[float] +[[defining-alerts-general-details]] +=== General rule details + +All rules share the following four properties. + +[role="screenshot"] +image::images/rule-flyout-general-details.png[alt='All rules have name, tags, check every, and notify properties in common'] + +Name:: The name of the rule. While this name does not have to be unique, the name can be referenced in actions and also appears in the searchable rule listing in the management UI. A distinctive name can help identify and find a rule. +Tags:: A list of tag names that can be applied to a rule. Tags can help you organize and find rules, because tags appear in the rule listing in the management UI which is searchable by tag. +Check every:: This value determines how frequently the rule conditions below are checked. Note that the timing of background rule checks are not guaranteed, particularly for intervals of less than 10 seconds. See <> for more information. +Notify:: This value limits how often actions are repeated when an alert remains active across rule checks. See <> for more information. + +- **Only on status change**: Actions are not repeated when an alert remains active across checks. Actions run only when the rule status changes. +- **Every time rule is active**: Actions are repeated when an alert remains active across checks. +- **On a custom action interval**: Actions are suppressed for the throttle interval, but repeat when an alert remains active across checks for a duration longer than the throttle interval. + + +[float] +[[defining-alerts-type-conditions]] +=== Rule type and conditions + +Depending upon the {kib} app and context, you may be prompted to choose the type of rule you wish to create. Some apps will pre-select the type of rule for you. + +[role="screenshot"] +image::images/rule-flyout-rule-type-selection.png[Choosing the type of rule to create] + +Each rule type provides its own way of defining the conditions to detect, but an expression formed by a series of clauses is a common pattern. Each clause has a UI control that allows you to define the clause. For example, in an index threshold rule the `WHEN` clause allows you to select an aggregation operation to apply to a numeric field. + +[role="screenshot"] +image::images/rule-flyout-rule-conditions.png[UI for defining rule conditions on an index threshold rule] + +[float] +[[defining-alerts-actions-details]] +=== Action type and action details + +To add an action to a rule, you first select the type of connector: + +[role="screenshot"] +image::images/rule-flyout-connector-type-selection.png[UI for selecting an action type] + +When an alert matches a condition, the rule is marked as _Active_ and assigned an action group. The actions in that group are triggered. +When the condition is no longer detected, the rule is assigned to the _Recovered_ action group, which triggers any actions assigned to that group. + +**Run When** allows you to assign an action to an action group. This will trigger the action in accordance with your **Notify** setting. + +Each action must specify a <> instance. If no connectors exist for that action type, click *Add connector* to create one. + +Each action type exposes different properties. For example an email action allows you to set the recipients, the subject, and a message body in markdown format. See <> for details on the types of actions provided by {kib} and their properties. + +[role="screenshot"] +image::images/rule-flyout-action-details.png[UI for defining an email action] + +[float] +[[defining-alerts-actions-variables]] +==== Action variables +Using the https://mustache.github.io/[Mustache] template syntax `{{variable name}}`, you can pass rule values at the time a condition is detected to an action. You can access the list of available variables using the "add variable" button. Although available variables differ by rule type, all rule types pass the following variables: + +`rule.id`:: The ID of the rule. +`rule.name`:: The name of the rule. +`rule.spaceId`:: The ID of the space for the rule. +`rule.tags`:: The list of tags applied to the rule. +`date`:: The date the rule scheduled the action, in ISO format. +`alert.id`:: The ID of the alert that scheduled the action. +`alert.actionGroup`:: The ID of the action group of the alert that scheduled the action. +`alert.actionSubgroup`:: The action subgroup of the alert that scheduled the action. +`alert.actionGroupName`:: The name of the action group of the alert that scheduled the action. +`kibanaBaseUrl`:: The configured <>. If not configured, this will be empty. + +[role="screenshot"] +image::images/rule-flyout-action-variables.png[Passing rule values to an action] + +Some cases exist where the variable values will be "escaped", when used in a context where escaping is needed: + +- For the <> connector, the `message` action configuration property escapes any characters that would be interpreted as Markdown. +- For the <> connector, the `message` action configuration property escapes any characters that would be interpreted as Slack Markdown. +- For the <> connector, the `body` action configuration property escapes any characters that are invalid in JSON string values. + +Mustache also supports "triple braces" of the form `{{{variable name}}}`, which indicates no escaping should be done at all. Care should be used when using this form, as it could end up rendering the variable content in such a way as to make the resulting parameter invalid or formatted incorrectly. + +Each rule type defines additional variables as properties of the variable `context`. For example, if a rule type defines a variable `value`, it can be used in an action parameter as `{{context.value}}`. + +For diagnostic or exploratory purposes, action variables whose values are objects, such as `context`, can be referenced directly as variables. The resulting value will be a JSON representation of the object. For example, if an action parameter includes `{{context}}`, it will expand to the JSON representation of all the variables and values provided by the rule type. + +You can attach more than one action. Clicking the "Add action" button will prompt you to select another rule type and repeat the above steps again. + +[role="screenshot"] +image::images/rule-flyout-add-action.png[You can add multiple actions on a rule] + +[NOTE] +============================================== +Actions are not required on rules. You can run a rule without actions to understand its behavior, and then <> later. +============================================== + +[float] +=== Manage rules + +To modify a rule after it was created, including muting or disabling it, use the <>. diff --git a/docs/user/alerting/images/alert-concepts-connectors.svg b/docs/user/alerting/images/alert-concepts-connectors.svg deleted file mode 100644 index 9ae4c21ee5870..0000000000000 --- a/docs/user/alerting/images/alert-concepts-connectors.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/docs/user/alerting/images/alert-concepts-summary.svg b/docs/user/alerting/images/alert-concepts-summary.svg deleted file mode 100644 index 0aed3bf22375f..0000000000000 --- a/docs/user/alerting/images/alert-concepts-summary.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/docs/user/alerting/images/alert-flyout-action-details.png b/docs/user/alerting/images/alert-flyout-action-details.png deleted file mode 100644 index 7547fc819f539..0000000000000 Binary files a/docs/user/alerting/images/alert-flyout-action-details.png and /dev/null differ diff --git a/docs/user/alerting/images/alert-flyout-action-type-selection.png b/docs/user/alerting/images/alert-flyout-action-type-selection.png deleted file mode 100644 index 2df2a031c6661..0000000000000 Binary files a/docs/user/alerting/images/alert-flyout-action-type-selection.png and /dev/null differ diff --git a/docs/user/alerting/images/alert-flyout-action-variables.png b/docs/user/alerting/images/alert-flyout-action-variables.png deleted file mode 100644 index 5b3684ad3fae4..0000000000000 Binary files a/docs/user/alerting/images/alert-flyout-action-variables.png and /dev/null differ diff --git a/docs/user/alerting/images/alert-flyout-alert-type-selection.png b/docs/user/alerting/images/alert-flyout-alert-type-selection.png deleted file mode 100644 index 6ebbe4213ba7d..0000000000000 Binary files a/docs/user/alerting/images/alert-flyout-alert-type-selection.png and /dev/null differ diff --git a/docs/user/alerting/images/alert-flyout-sections.png b/docs/user/alerting/images/alert-flyout-sections.png deleted file mode 100644 index 8fa4bfffe39a3..0000000000000 Binary files a/docs/user/alerting/images/alert-flyout-sections.png and /dev/null differ diff --git a/docs/user/alerting/images/alert-instances.svg b/docs/user/alerting/images/alert-instances.svg deleted file mode 100644 index 97f610041f0eb..0000000000000 --- a/docs/user/alerting/images/alert-instances.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/docs/user/alerting/images/alert-pre-configured-connectors-dropdown.png b/docs/user/alerting/images/alert-pre-configured-connectors-dropdown.png deleted file mode 100644 index 081688758eb48..0000000000000 Binary files a/docs/user/alerting/images/alert-pre-configured-connectors-dropdown.png and /dev/null differ diff --git a/docs/user/alerting/images/alert-pre-configured-slack-connector.png b/docs/user/alerting/images/alert-pre-configured-slack-connector.png deleted file mode 100644 index e9d81877fbf4f..0000000000000 Binary files a/docs/user/alerting/images/alert-pre-configured-slack-connector.png and /dev/null differ diff --git a/docs/user/alerting/images/alert-types-es-query-example-action-variable.png b/docs/user/alerting/images/alert-types-es-query-example-action-variable.png deleted file mode 100644 index 7e40499d78fdd..0000000000000 Binary files a/docs/user/alerting/images/alert-types-es-query-example-action-variable.png and /dev/null differ diff --git a/docs/user/alerting/images/alert-types-es-query-select.png b/docs/user/alerting/images/alert-types-es-query-select.png deleted file mode 100644 index 61fe724ea1412..0000000000000 Binary files a/docs/user/alerting/images/alert-types-es-query-select.png and /dev/null differ diff --git a/docs/user/alerting/images/alert-types-index-threshold-select.png b/docs/user/alerting/images/alert-types-index-threshold-select.png deleted file mode 100644 index 7a68d8815b6d9..0000000000000 Binary files a/docs/user/alerting/images/alert-types-index-threshold-select.png and /dev/null differ diff --git a/docs/user/alerting/images/alerting-overview.png b/docs/user/alerting/images/alerting-overview.png index b4ec6f3df6028..7a4124f1b0377 100644 Binary files a/docs/user/alerting/images/alerting-overview.png and b/docs/user/alerting/images/alerting-overview.png differ diff --git a/docs/user/alerting/images/alerts.svg b/docs/user/alerting/images/alerts.svg new file mode 100644 index 0000000000000..022b3106ae802 --- /dev/null +++ b/docs/user/alerting/images/alerts.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/docs/user/alerting/images/pre-configured-action-type-alert-form.png b/docs/user/alerting/images/pre-configured-action-type-alert-form.png deleted file mode 100644 index e12bad468009a..0000000000000 Binary files a/docs/user/alerting/images/pre-configured-action-type-alert-form.png and /dev/null differ diff --git a/docs/user/alerting/images/pre-configured-action-type-managing.png b/docs/user/alerting/images/pre-configured-action-type-managing.png deleted file mode 100644 index 95fe1c6aa0958..0000000000000 Binary files a/docs/user/alerting/images/pre-configured-action-type-managing.png and /dev/null differ diff --git a/docs/user/alerting/images/pre-configured-action-type-select-type.png b/docs/user/alerting/images/pre-configured-action-type-select-type.png deleted file mode 100644 index 91ca831840ce9..0000000000000 Binary files a/docs/user/alerting/images/pre-configured-action-type-select-type.png and /dev/null differ diff --git a/docs/user/alerting/images/pre-configured-connectors-managing.png b/docs/user/alerting/images/pre-configured-connectors-managing.png index f97e93175fa36..e41b89b331007 100644 Binary files a/docs/user/alerting/images/pre-configured-connectors-managing.png and b/docs/user/alerting/images/pre-configured-connectors-managing.png differ diff --git a/docs/user/alerting/images/pre-configured-connectors-view-screen.png b/docs/user/alerting/images/pre-configured-connectors-view-screen.png index 9c75f86498beb..b2d00b307000e 100644 Binary files a/docs/user/alerting/images/pre-configured-connectors-view-screen.png and b/docs/user/alerting/images/pre-configured-connectors-view-screen.png differ diff --git a/docs/user/alerting/images/rule-concepts-connectors.svg b/docs/user/alerting/images/rule-concepts-connectors.svg new file mode 100644 index 0000000000000..caee5f858fea9 --- /dev/null +++ b/docs/user/alerting/images/rule-concepts-connectors.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/docs/user/alerting/images/rule-concepts-summary.svg b/docs/user/alerting/images/rule-concepts-summary.svg new file mode 100644 index 0000000000000..aed7020b9d3e2 --- /dev/null +++ b/docs/user/alerting/images/rule-concepts-summary.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/docs/user/alerting/images/rule-flyout-action-details.png b/docs/user/alerting/images/rule-flyout-action-details.png new file mode 100644 index 0000000000000..682829619a2a6 Binary files /dev/null and b/docs/user/alerting/images/rule-flyout-action-details.png differ diff --git a/docs/user/alerting/images/rule-flyout-action-variables.png b/docs/user/alerting/images/rule-flyout-action-variables.png new file mode 100644 index 0000000000000..31da8a2d58021 Binary files /dev/null and b/docs/user/alerting/images/rule-flyout-action-variables.png differ diff --git a/docs/user/alerting/images/alert-flyout-add-action.png b/docs/user/alerting/images/rule-flyout-add-action.png similarity index 100% rename from docs/user/alerting/images/alert-flyout-add-action.png rename to docs/user/alerting/images/rule-flyout-add-action.png diff --git a/docs/user/alerting/images/rule-flyout-connector-type-selection.png b/docs/user/alerting/images/rule-flyout-connector-type-selection.png new file mode 100644 index 0000000000000..88428110a8f66 Binary files /dev/null and b/docs/user/alerting/images/rule-flyout-connector-type-selection.png differ diff --git a/docs/user/alerting/images/alert-flyout-general-details.png b/docs/user/alerting/images/rule-flyout-general-details.png similarity index 100% rename from docs/user/alerting/images/alert-flyout-general-details.png rename to docs/user/alerting/images/rule-flyout-general-details.png diff --git a/docs/user/alerting/images/alert-flyout-alert-conditions.png b/docs/user/alerting/images/rule-flyout-rule-conditions.png similarity index 100% rename from docs/user/alerting/images/alert-flyout-alert-conditions.png rename to docs/user/alerting/images/rule-flyout-rule-conditions.png diff --git a/docs/user/alerting/images/rule-flyout-rule-type-selection.png b/docs/user/alerting/images/rule-flyout-rule-type-selection.png new file mode 100644 index 0000000000000..40f2ce44b631d Binary files /dev/null and b/docs/user/alerting/images/rule-flyout-rule-type-selection.png differ diff --git a/docs/user/alerting/images/rule-flyout-sections.png b/docs/user/alerting/images/rule-flyout-sections.png new file mode 100644 index 0000000000000..773c6a6fa8dbc Binary files /dev/null and b/docs/user/alerting/images/rule-flyout-sections.png differ diff --git a/docs/user/alerting/images/alert-types-es-query-conditions.png b/docs/user/alerting/images/rule-types-es-query-conditions.png similarity index 100% rename from docs/user/alerting/images/alert-types-es-query-conditions.png rename to docs/user/alerting/images/rule-types-es-query-conditions.png diff --git a/docs/user/alerting/images/rule-types-es-query-example-action-variable.png b/docs/user/alerting/images/rule-types-es-query-example-action-variable.png new file mode 100644 index 0000000000000..8cb5c07543ddc Binary files /dev/null and b/docs/user/alerting/images/rule-types-es-query-example-action-variable.png differ diff --git a/docs/user/alerting/images/alert-types-es-query-invalid.png b/docs/user/alerting/images/rule-types-es-query-invalid.png similarity index 100% rename from docs/user/alerting/images/alert-types-es-query-invalid.png rename to docs/user/alerting/images/rule-types-es-query-invalid.png diff --git a/docs/user/alerting/images/alert-types-es-query-valid.png b/docs/user/alerting/images/rule-types-es-query-valid.png similarity index 100% rename from docs/user/alerting/images/alert-types-es-query-valid.png rename to docs/user/alerting/images/rule-types-es-query-valid.png diff --git a/docs/user/alerting/images/alert-types-index-threshold-conditions.png b/docs/user/alerting/images/rule-types-index-threshold-conditions.png similarity index 100% rename from docs/user/alerting/images/alert-types-index-threshold-conditions.png rename to docs/user/alerting/images/rule-types-index-threshold-conditions.png diff --git a/docs/user/alerting/images/alert-types-index-threshold-example-aggregation.png b/docs/user/alerting/images/rule-types-index-threshold-example-aggregation.png similarity index 100% rename from docs/user/alerting/images/alert-types-index-threshold-example-aggregation.png rename to docs/user/alerting/images/rule-types-index-threshold-example-aggregation.png diff --git a/docs/user/alerting/images/alert-types-index-threshold-example-comparison.png b/docs/user/alerting/images/rule-types-index-threshold-example-comparison.png similarity index 100% rename from docs/user/alerting/images/alert-types-index-threshold-example-comparison.png rename to docs/user/alerting/images/rule-types-index-threshold-example-comparison.png diff --git a/docs/user/alerting/images/alert-types-index-threshold-example-grouping.png b/docs/user/alerting/images/rule-types-index-threshold-example-grouping.png similarity index 100% rename from docs/user/alerting/images/alert-types-index-threshold-example-grouping.png rename to docs/user/alerting/images/rule-types-index-threshold-example-grouping.png diff --git a/docs/user/alerting/images/alert-types-index-threshold-example-index.png b/docs/user/alerting/images/rule-types-index-threshold-example-index.png similarity index 100% rename from docs/user/alerting/images/alert-types-index-threshold-example-index.png rename to docs/user/alerting/images/rule-types-index-threshold-example-index.png diff --git a/docs/user/alerting/images/alert-types-index-threshold-example-preview.png b/docs/user/alerting/images/rule-types-index-threshold-example-preview.png similarity index 100% rename from docs/user/alerting/images/alert-types-index-threshold-example-preview.png rename to docs/user/alerting/images/rule-types-index-threshold-example-preview.png diff --git a/docs/user/alerting/images/alert-types-index-threshold-example-threshold.png b/docs/user/alerting/images/rule-types-index-threshold-example-threshold.png similarity index 100% rename from docs/user/alerting/images/alert-types-index-threshold-example-threshold.png rename to docs/user/alerting/images/rule-types-index-threshold-example-threshold.png diff --git a/docs/user/alerting/images/alert-types-index-threshold-example-timefield.png b/docs/user/alerting/images/rule-types-index-threshold-example-timefield.png similarity index 100% rename from docs/user/alerting/images/alert-types-index-threshold-example-timefield.png rename to docs/user/alerting/images/rule-types-index-threshold-example-timefield.png diff --git a/docs/user/alerting/images/alert-types-index-threshold-example-window.png b/docs/user/alerting/images/rule-types-index-threshold-example-window.png similarity index 100% rename from docs/user/alerting/images/alert-types-index-threshold-example-window.png rename to docs/user/alerting/images/rule-types-index-threshold-example-window.png diff --git a/docs/user/alerting/images/alert-types-index-threshold-preview.png b/docs/user/alerting/images/rule-types-index-threshold-preview.png similarity index 100% rename from docs/user/alerting/images/alert-types-index-threshold-preview.png rename to docs/user/alerting/images/rule-types-index-threshold-preview.png diff --git a/docs/user/alerting/images/rule-types-index-threshold-select.png b/docs/user/alerting/images/rule-types-index-threshold-select.png new file mode 100644 index 0000000000000..aeb9de279b3a1 Binary files /dev/null and b/docs/user/alerting/images/rule-types-index-threshold-select.png differ diff --git a/docs/user/alerting/images/what-is-a-rule.svg b/docs/user/alerting/images/what-is-a-rule.svg new file mode 100644 index 0000000000000..2117e448ba136 --- /dev/null +++ b/docs/user/alerting/images/what-is-a-rule.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/docs/user/alerting/images/what-is-an-action.svg b/docs/user/alerting/images/what-is-an-action.svg index 7675f717a6c84..f8435ee24fc19 100644 --- a/docs/user/alerting/images/what-is-an-action.svg +++ b/docs/user/alerting/images/what-is-an-action.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/docs/user/alerting/images/what-is-an-alert.svg b/docs/user/alerting/images/what-is-an-alert.svg deleted file mode 100644 index b4dc02fae39a5..0000000000000 --- a/docs/user/alerting/images/what-is-an-alert.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/docs/user/alerting/index.asciidoc b/docs/user/alerting/index.asciidoc index be95fe0ef0f86..a29ca1c4ca012 100644 --- a/docs/user/alerting/index.asciidoc +++ b/docs/user/alerting/index.asciidoc @@ -1,5 +1,5 @@ include::alerting-getting-started.asciidoc[] -include::defining-alerts.asciidoc[] +include::defining-rules.asciidoc[] include::action-types.asciidoc[] -include::alert-types.asciidoc[] +include::rule-types.asciidoc[] include::alerting-troubleshooting.asciidoc[] diff --git a/docs/user/alerting/maps-alerts/geo-alert-types.asciidoc b/docs/user/alerting/map-rules/geo-rule-types.asciidoc similarity index 68% rename from docs/user/alerting/maps-alerts/geo-alert-types.asciidoc rename to docs/user/alerting/map-rules/geo-rule-types.asciidoc index f899cd0204b9a..4b17145c2d149 100644 --- a/docs/user/alerting/maps-alerts/geo-alert-types.asciidoc +++ b/docs/user/alerting/map-rules/geo-rule-types.asciidoc @@ -1,16 +1,16 @@ [role="xpack"] [[geo-alerting]] -=== Geo alerting +=== Geo rule type -Alerting now includes one additional stack alert: <>. +Alerting now includes one additional stack rule: <>. -As with other stack alerts, you need `all` access to the *Stack Alerts* feature -to be able to create and edit a geo alert. +As with other stack rules, you need `all` access to the *Stack Rules* feature +to be able to create and edit a geo rule. See <> for more information on configuring roles that provide access to this feature. [float] ==== Geo alerting requirements -To create a *Tracking containment* alert, the following requirements must be present: +To create a *Tracking containment* rule, the following requirements must be present: - *Tracks index or index pattern*: An index containing a `geo_point` field, `date` field, and some form of entity identifier. An entity identifier is a `keyword` or `number` @@ -18,7 +18,7 @@ field that consistently identifies the entity to be tracked. The data in this in updating so that there are entity movements to alert upon. - *Boundaries index or index pattern*: An index containing `geo_shape` data, such as boundary data and bounding box data. This data is presumed to be static (not updating). Shape data matching the query is -harvested once when the alert is created and anytime after when the alert is re-enabled +harvested once when the rule is created and anytime after when the rule is re-enabled after disablement. By design, current interval entity locations (_current_ is determined by `date` in @@ -26,26 +26,26 @@ the *Tracked index or index pattern*) are queried to determine if they are conta within any monitored boundaries. Entity data should be somewhat "real time", meaning the dates of new documents aren’t older than the current time minus the amount of the interval. If data older than -`now - ` is ingested, it won't trigger an alert. +`now - ` is ingested, it won't trigger a rule. [float] -==== Creating a geo alert -Click the *Create* button in the <>. -Complete the <>. +==== Creating a geo rule +Click the *Create* button in the <>. +Complete the <>. [role="screenshot"] -image::user/alerting/images/alert-types-tracking-select.png[Choosing a tracking alert type] +image::user/alerting/images/alert-types-tracking-select.png[Choosing a tracking rule type] [float] -[[alert-type-tracking-containment]] +[[rule-type-tracking-containment]] ==== Tracking containment -The Tracking containment alert type runs an {es} query over indices, determining if any +The Tracking containment rule type runs an {es} query over indices, determining if any documents are currently contained within any boundaries from the specified boundary index. In the event that an entity is contained within a boundary, an alert may be generated. [float] ===== Defining the conditions -Tracking containment alerts have 3 clauses that define the condition to detect, +Tracking containment rules have 3 clauses that define the condition to detect, as well as 2 Kuery bars used to provide additional filtering context for each of the indices. [role="screenshot"] @@ -54,15 +54,15 @@ image::user/alerting/images/alert-types-tracking-containment-conditions.png[Five Index (entity):: This clause requires an *index or index pattern*, a *time field* that will be used for the *time window*, and a *`geo_point` field* for tracking. When entity:: This clause specifies which crossing option to track. The values *Entered*, *Exited*, and *Crossed* can be selected to indicate which crossing conditions -should trigger an alert. *Entered* alerts on entry into a boundary, *Exited* alerts on exit +should trigger a rule. *Entered* alerts on entry into a boundary, *Exited* alerts on exit from a boundary, and *Crossed* alerts on all boundary crossings whether they be entrances or exits. Index (Boundary):: This clause requires an *index or index pattern*, a *`geo_shape` field* identifying boundaries, and an optional *Human-readable boundary name* for better alerting messages. -Conditions for how an alert is tracked can be specified uniquely for each individual action. -An alert can be triggered either when a containment condition is met or when an entity +Conditions for how a rule is tracked can be specified uniquely for each individual action. +A rule can be triggered either when a containment condition is met or when an entity is no longer contained. [role="screenshot"] diff --git a/docs/user/alerting/rule-types.asciidoc b/docs/user/alerting/rule-types.asciidoc new file mode 100644 index 0000000000000..44a22c548757c --- /dev/null +++ b/docs/user/alerting/rule-types.asciidoc @@ -0,0 +1,42 @@ +[role="xpack"] +[[rule-types]] +== Rules + +Kibana provides two types of rules: + +* Stack rules, which are built into {kib} +* Domain-specific rules, which are registered by {kib} apps. + +[float] +==== Standard stack rules + +{kib} provides two stack rules: + +* <> +* <> + +Users require the `all` privilege to access the *Stack Rules* feature and create and edit rules. +See <> for more information. + +[float] +==== Domain-specific rules + +For domain-specific rules, refer to the documentation for that app. +{kib} supports these rules: + +* {observability-guide}/create-alerts.html[Observability rules] +* {security-guide}/prebuilt-rules.html[Security rules] +* <> +* {ml-docs}/ml-configuring-alerts.html[{ml-cap} rules] beta:[] + +[NOTE] +============================================== +Some rule types are subscription features, while others are free features. +For a comparison of the Elastic subscription levels, +see {subscriptions}[the subscription page]. +============================================== + + +include::stack-rules/index-threshold.asciidoc[] +include::stack-rules/es-query.asciidoc[] +include::map-rules/geo-rule-types.asciidoc[] diff --git a/docs/user/alerting/stack-alerts/es-query.asciidoc b/docs/user/alerting/stack-rules/es-query.asciidoc similarity index 60% rename from docs/user/alerting/stack-alerts/es-query.asciidoc rename to docs/user/alerting/stack-rules/es-query.asciidoc index cac53f6600163..c62ebbf4bf2bc 100644 --- a/docs/user/alerting/stack-alerts/es-query.asciidoc +++ b/docs/user/alerting/stack-rules/es-query.asciidoc @@ -1,13 +1,13 @@ [role="xpack"] -[[alert-type-es-query]] +[[rule-type-es-query]] === {es} query -The {es} query alert type runs a user-configured {es} query, compares the number of matches to a configured threshold, and schedules actions to run when the threshold condition is met. +The {es} query rule type runs a user-configured {es} query, compares the number of matches to a configured threshold, and schedules actions to run when the threshold condition is met. [float] -==== Create the alert +==== Create the rule -Fill in the <>, then select *{es} query*. +Fill in the <>, then select *{es} query*. [float] ==== Define the conditions @@ -15,35 +15,35 @@ Fill in the <>, then select *{es Define properties to detect the condition. [role="screenshot"] -image::user/alerting/images/alert-types-es-query-conditions.png[Five clauses define the condition to detect] +image::user/alerting/images/rule-types-es-query-conditions.png[Five clauses define the condition to detect] Index:: This clause requires an *index or index pattern* and a *time field* that will be used for the *time window*. Size:: This clause specifies the number of documents to pass to the configured actions when the the threshold condition is met. {es} query:: This clause specifies the ES DSL query to execute. The number of documents that match this query will be evaulated against the threshold condition. Aggregations are not supported at this time. Threshold:: This clause defines a threshold value and a comparison operator (`is above`, `is above or equals`, `is below`, `is below or equals`, or `is between`). The number of documents that match the specified query is compared to this threshold. -Time window:: This clause determines how far back to search for documents, using the *time field* set in the *index* clause. Generally this value should be set to a value higher than the *check every* value in the <>, to avoid gaps in detection. +Time window:: This clause determines how far back to search for documents, using the *time field* set in the *index* clause. Generally this value should be set to a value higher than the *check every* value in the <>, to avoid gaps in detection. [float] ==== Add action variables -<> to run when the alert condition is met. The following variables are specific to the {es} query alert. You can also specify <>. +<> to run when the rule condition is met. The following variables are specific to the {es} query rule. You can also specify <>. -`context.title`:: A preconstructed title for the alert. Example: `alert term match alert query matched`. -`context.message`:: A preconstructed message for the alert. Example: + -`alert 'term match alert' is active:` + +`context.title`:: A preconstructed title for the rule. Example: `rule term match alert query matched`. +`context.message`:: A preconstructed message for the rule. Example: + +`rule 'term match alert' is active:` + `- Value: 42` + `- Conditions Met: count greater than 4 over 5m` + `- Timestamp: 2020-01-01T00:00:00.000Z` `context.group`:: The name of the action group associated with the condition. Example: `query matched`. -`context.date`:: The date, in ISO format, that the alert met the condition. Example: `2020-01-01T00:00:00.000Z`. -`context.value`:: The value of the alert that met the condition. +`context.date`:: The date, in ISO format, that the rule met the condition. Example: `2020-01-01T00:00:00.000Z`. +`context.value`:: The value of the rule that met the condition. `context.conditions`:: A description of the condition. Example: `count greater than 4`. `context.hits`:: The most recent ES documents that matched the query. Using the https://mustache.github.io/[Mustache] template array syntax, you can iterate over these hits to get values from the ES documents into your actions. + [role="screenshot"] -image::images/alert-types-es-query-example-action-variable.png[Iterate over hits using Mustache template syntax] +image::images/rule-types-es-query-example-action-variable.png[Iterate over hits using Mustache template syntax] [float] @@ -55,9 +55,9 @@ Use the *Test query* feature to verify that your query DSL is valid. match the query will be displayed. + [role="screenshot"] -image::user/alerting/images/alert-types-es-query-valid.png[Test {es} query returns number of matches when valid] +image::user/alerting/images/rule-types-es-query-valid.png[Test {es} query returns number of matches when valid] * An error message is shown if the query is invalid. + [role="screenshot"] -image::user/alerting/images/alert-types-es-query-invalid.png[Test {es} query shows error when invalid] \ No newline at end of file +image::user/alerting/images/rule-types-es-query-invalid.png[Test {es} query shows error when invalid] \ No newline at end of file diff --git a/docs/user/alerting/stack-alerts/index-threshold.asciidoc b/docs/user/alerting/stack-rules/index-threshold.asciidoc similarity index 50% rename from docs/user/alerting/stack-alerts/index-threshold.asciidoc rename to docs/user/alerting/stack-rules/index-threshold.asciidoc index 89ca8e3087f12..43b750b85fb3b 100644 --- a/docs/user/alerting/stack-alerts/index-threshold.asciidoc +++ b/docs/user/alerting/stack-rules/index-threshold.asciidoc @@ -1,13 +1,13 @@ [role="xpack"] -[[alert-type-index-threshold]] +[[rule-type-index-threshold]] === Index threshold -The index threshold alert type runs an {es} query. It aggregates field values from documents, compares them to threshold values, and schedules actions to run when the thresholds are met. +The index threshold rule type runs an {es} query. It aggregates field values from documents, compares them to threshold values, and schedules actions to run when the thresholds are met. [float] -==== Create the alert +==== Create the rule -Fill in the <>, then select *Index Threshold*. +Fill in the <>, then select *Index Threshold*. [float] ==== Define the conditions @@ -15,86 +15,86 @@ Fill in the <>, then select *Ind Define properties to detect the condition. [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-conditions.png[Five clauses define the condition to detect] +image::user/alerting/images/rule-types-index-threshold-conditions.png[Five clauses define the condition to detect] Index:: This clause requires an *index or index pattern* and a *time field* that will be used for the *time window*. When:: This clause specifies how the value to be compared to the threshold is calculated. The value is calculated by aggregating a numeric field a the *time window*. The aggregation options are: `count`, `average`, `sum`, `min`, and `max`. When using `count` the document count is used, and an aggregation field is not necessary. -Over/Grouped Over:: This clause lets you configure whether the aggregation is applied over all documents, or should be split into groups using a grouping field. If grouping is used, an <> will be created for each group when it exceeds the threshold. To limit the number of instances on high cardinality fields, you must specify the number of groups to check against the threshold. Only the *top* groups are checked. +Over/Grouped Over:: This clause lets you configure whether the aggregation is applied over all documents, or should be split into groups using a grouping field. If grouping is used, an <> will be created for each group when it exceeds the threshold. To limit the number of alerts on high cardinality fields, you must specify the number of groups to check against the threshold. Only the *top* groups are checked. Threshold:: This clause defines a threshold value and a comparison operator (one of `is above`, `is above or equals`, `is below`, `is below or equals`, or `is between`). The result of the aggregation is compared to this threshold. -Time window:: This clause determines how far back to search for documents, using the *time field* set in the *index* clause. Generally this value should be to a value higher than the *check every* value in the <>, to avoid gaps in detection. +Time window:: This clause determines how far back to search for documents, using the *time field* set in the *index* clause. Generally this value should be to a value higher than the *check every* value in the <>, to avoid gaps in detection. If data is available and all clauses have been defined, a preview chart will render the threshold value and display a line chart showing the value for the last 30 intervals. This can provide an indication of recent values and their proximity to the threshold, and help you tune the clauses. [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-preview.png[Five clauses define the condition to detect] +image::user/alerting/images/rule-types-index-threshold-preview.png[Five clauses define the condition to detect] [float] ==== Add action variables -<> to run when the alert condition is met. The following variables are specific to the index threshold alert. You can also specify <>. +<> to run when the rule condition is met. The following variables are specific to the index threshold rule. You can also specify <>. -`context.title`:: A preconstructed title for the alert. Example: `alert kibana sites - high egress met threshold`. -`context.message`:: A preconstructed message for the alert. Example: + -`alert 'kibana sites - high egress' is active for group 'threshold met':` + +`context.title`:: A preconstructed title for the rule. Example: `rule kibana sites - high egress met threshold`. +`context.message`:: A preconstructed message for the rule. Example: + +`rule 'kibana sites - high egress' is active for group 'threshold met':` + `- Value: 42` + `- Conditions Met: count greater than 4 over 5m` + `- Timestamp: 2020-01-01T00:00:00.000Z` `context.group`:: The name of the action group associated with the threshold condition. Example: `threshold met`. -`context.date`:: The date, in ISO format, that the alert met the threshold condition. Example: `2020-01-01T00:00:00.000Z`. -`context.value`:: The value for the alert that met the threshold condition. +`context.date`:: The date, in ISO format, that the rule met the threshold condition. Example: `2020-01-01T00:00:00.000Z`. +`context.value`:: The value for the rule that met the threshold condition. `context.conditions`:: A description of the threshold condition. Example: `count greater than 4` [float] ==== Example -In this example, you will use the {kib} <> to set up and tune the conditions on an index threshold alert. For this example, you want to detect when any of the top four sites serve more than 420,000 bytes over a 24 hour period. +In this example, you will use the {kib} <> to set up and tune the conditions on an index threshold rule. For this example, you want to detect when any of the top four sites serve more than 420,000 bytes over a 24 hour period. -. Open the main menu, then click **Stack Management > Alerts and Actions**. +. Open the main menu, then click **Stack Management > Rules and Connectors**. -. Create a new alert that is checked every four hours and executes actions when the alert status changes. +. Create a new rule that is checked every four hours and executes actions when the rule status changes. + [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-select.png[Choosing an index threshold alert type] +image::user/alerting/images/rule-types-index-threshold-select.png[Choosing an index threshold rule type] -. Select the **Index threshold** alert type. +. Select the **Index threshold** rule type. . Click *Index*, and set *Indices to query* to *kibana_sample_data_logs*. + [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-example-index.png[Choosing an index] +image::user/alerting/images/rule-types-index-threshold-example-index.png[Choosing an index] . Set the *Time field* to *@timestamp*. + [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-example-timefield.png[Choosing a time field] +image::user/alerting/images/rule-types-index-threshold-example-timefield.png[Choosing a time field] . To detect the number of bytes served during the time window, click *When* and select `sum` as the aggregation, and bytes as the field to aggregate. + [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-example-aggregation.png[Choosing the aggregation] +image::user/alerting/images/rule-types-index-threshold-example-aggregation.png[Choosing the aggregation] . To detect the four sites that have the most traffic, click *Over* and select `top`, enter `4`, and select `host.keyword` as the field. + [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-example-grouping.png[Choosing the groups] +image::user/alerting/images/rule-types-index-threshold-example-grouping.png[Choosing the groups] -. To alert when any of the top four sites exceeds 420,000 bytes over a 24 hour period, select `is above` and enter `420000`. +. To trigger the rule when any of the top four sites exceeds 420,000 bytes over a 24 hour period, select `is above` and enter `420000`. + [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-example-threshold.png[Setting the threshold] +image::user/alerting/images/rule-types-index-threshold-example-threshold.png[Setting the threshold] -. Finally, click *For the last*, enter `24` and select `hours` to complete the alert configuration. +. Finally, click *For the last*, enter `24` and select `hours` to complete the rule configuration. + [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-example-window.png[Setting the time window] +image::user/alerting/images/rule-types-index-threshold-example-window.png[Setting the time window] . The preview chart will render showing the 24 hour sum of bytes at 4 hours intervals (the *check every* interval) for the past 120 hours (the last 30 intervals). + [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-example-preview.png[Setting the time window] +image::user/alerting/images/rule-types-index-threshold-example-preview.png[Setting the time window] -. Change the time window and observe the effect it has on the chart. Compare a 24 window to a 12 hour window. Notice the variability in the sum of bytes, due to different traffic levels during the day compared to at night. This variability would result in noisy alerts, so the 24 hour window is better. The preview chart can help you find the right values for your alert. +. Change the time window and observe the effect it has on the chart. Compare a 24 window to a 12 hour window. Notice the variability in the sum of bytes, due to different traffic levels during the day compared to at night. This variability would result in noisy rules, so the 24 hour window is better. The preview chart can help you find the right values for your rule. + [role="screenshot"] -image::user/alerting/images/alert-types-index-threshold-example-comparison.png[Comparing two time windows] \ No newline at end of file +image::user/alerting/images/rule-types-index-threshold-example-comparison.png[Comparing two time windows] \ No newline at end of file diff --git a/docs/user/images/alerts-and-actions.png b/docs/user/images/alerts-and-actions.png deleted file mode 100755 index 227abd9441e15..0000000000000 Binary files a/docs/user/images/alerts-and-actions.png and /dev/null differ diff --git a/docs/user/images/rules-and-connectors.png b/docs/user/images/rules-and-connectors.png new file mode 100644 index 0000000000000..5cda25b54536f Binary files /dev/null and b/docs/user/images/rules-and-connectors.png differ diff --git a/docs/user/introduction.asciidoc b/docs/user/introduction.asciidoc index 8ab29f375484c..8a0dd5e4e2a2b 100644 --- a/docs/user/introduction.asciidoc +++ b/docs/user/introduction.asciidoc @@ -170,24 +170,24 @@ image::images/intro-management.png[Index Management view in Stack Management] [float] ==== Alert and take action Detecting and acting on significant shifts and signals in your data is a need -that exists in almost every use case. For example, you might set an alert to notify you when: +that exists in almost every use case. For example, you might set a rule to notify you when: * A shift occurs in your business critical KPIs. * System resources, such as memory, CPU and disk space, take a dip. * An unusually high number of service requests, suspicious processes, and login attempts occurs. -An alert triggers when a specified condition is met. For example, -you can trigger an alert when the average or max of one of +A rule triggers when a specified condition is met. For example, +you can create a rule when the average or max of one of your metrics exceeds a threshold within a specified time frame. -When the alert triggers, you can send a notification to a system that is part of +When the rule triggers, you can send a notification to a system that is part of your daily workflow. {kib} integrates with email, Slack, PagerDuty, and ServiceNow, to name a few. -A dedicated view for creating, searching, and editing alerts is in <>. +A dedicated view for creating, searching, and editing rules is in <>. [role="screenshot"] -image::images/alerts-and-actions.png[Alerts and Actions view] +image::images/rules-and-connectors.png[Rules and Connectors view] [float] @@ -425,8 +425,8 @@ the <>. |Manage your Elasticsearch data |< Data>> -|Set up alerts -|< Alerts and Actions>> +|Set up rules +|< Rules and Connectors>> |Organize your workspace and users |< Spaces>> diff --git a/docs/user/management.asciidoc b/docs/user/management.asciidoc index 9d2b0ae593b34..f29718e6d588b 100644 --- a/docs/user/management.asciidoc +++ b/docs/user/management.asciidoc @@ -79,8 +79,8 @@ You can add and remove remote clusters, and check their connectivity. [cols="50, 50"] |=== -| <> -| Centrally manage your alerts across {kib}. Create and manage reusable +| <> +| Centrally manage your rules across {kib}. Create and manage reusable connectors for triggering actions. | <> @@ -177,11 +177,11 @@ next major version of {es}, and then reindex, if needed. include::{kib-repo-dir}/management/advanced-options.asciidoc[] -include::{kib-repo-dir}/management/alerting/alerts-and-actions-intro.asciidoc[] +include::{kib-repo-dir}/management/alerting/rules-and-connectors-intro.asciidoc[] -include::{kib-repo-dir}/management/alerting/alert-management.asciidoc[] +include::{kib-repo-dir}/management/alerting/rule-management.asciidoc[] -include::{kib-repo-dir}/management/alerting/alert-details.asciidoc[] +include::{kib-repo-dir}/management/alerting/rule-details.asciidoc[] include::{kib-repo-dir}/management/alerting/connector-management.asciidoc[] diff --git a/docs/user/production-considerations/alerting-production-considerations.asciidoc b/docs/user/production-considerations/alerting-production-considerations.asciidoc index 77c24becef8ef..57c255c809dc5 100644 --- a/docs/user/production-considerations/alerting-production-considerations.asciidoc +++ b/docs/user/production-considerations/alerting-production-considerations.asciidoc @@ -6,27 +6,27 @@ Alerting ++++ -Alerting runs both alert checks and actions as persistent background tasks managed by the Task Manager. +Alerting runs both rule checks and actions as persistent background tasks managed by the Task Manager. -When relying on alerts and actions as mission critical services, make sure you follow the <> for Task Manager. +When relying on rules and actions as mission critical services, make sure you follow the <> for Task Manager. [float] [[alerting-background-tasks]] -=== Running background alert checks and actions +=== Running background rule checks and actions -{kib} uses background tasks to run alerts and actions, distributed across all {kib} instances in the cluster. +{kib} uses background tasks to run rules and actions, distributed across all {kib} instances in the cluster. By default, each {kib} instance polls for work at three second intervals, and can run a maximum of ten concurrent tasks. These tasks are then run on the {kib} server. -Alerts are recurring background tasks which are rescheduled according to the <> on completion. +Rules are recurring background tasks which are rescheduled according to the <> on completion. Actions are non-recurring background tasks which are deleted on completion. For more details on Task Manager, see <>. [IMPORTANT] ============================================== -Alert and action tasks can run late or at an inconsistent schedule. +Rule and action tasks can run late or at an inconsistent schedule. This is typically a symptom of the specific usage of the cluster in question. You can address such issues by tweaking the <> or scaling the deployment to better suit your use case. @@ -38,14 +38,14 @@ For detailed guidance, see < [[alerting-scaling-guidance]] === Scaling Guidance -As alerts and actions leverage background tasks to perform the majority of work, scaling Alerting is possible by following the <>. +As rules and actions leverage background tasks to perform the majority of work, scaling Alerting is possible by following the <>. When estimating the required task throughput, keep the following in mind: -* Each alert uses a single recurring task that is scheduled to run at the cadence defined by its <>. +* Each rule uses a single recurring task that is scheduled to run at the cadence defined by its <>. * Each action uses a single task. However, because <>, alerts can generate a large number of non-recurring tasks. -It is difficult to predict how much throughput is needed to ensure all alerts and actions are executed at consistent schedules. -By counting alerts as recurring tasks and actions as non-recurring tasks, a rough throughput <> as a _tasks per minute_ measurement. +It is difficult to predict how much throughput is needed to ensure all rules and actions are executed at consistent schedules. +By counting rules as recurring tasks and actions as non-recurring tasks, a rough throughput <> as a _tasks per minute_ measurement. -Predicting the buffer required to account for actions depends heavily on the alert types you use, the amount of alert Instances they might detect, and the number of actions you might choose to assign to action groups. With that in mind, regularly <> of your Task Manager instances. +Predicting the buffer required to account for actions depends heavily on the rule types you use, the amount of alerts they might detect, and the number of actions you might choose to assign to action groups. With that in mind, regularly <> of your Task Manager instances. diff --git a/x-pack/examples/alerting_example/public/application.tsx b/x-pack/examples/alerting_example/public/application.tsx index 3c869eb3438cc..a9d0b9fc84905 100644 --- a/x-pack/examples/alerting_example/public/application.tsx +++ b/x-pack/examples/alerting_example/public/application.tsx @@ -43,10 +43,10 @@ const AlertingExampleApp = ({ )} /> ) => { return ( - + ); @@ -56,7 +56,7 @@ const AlertingExampleApp = ({ path={`/astros/:id`} render={(props: RouteComponentProps<{ id: string }>) => { return ( - + ); diff --git a/x-pack/examples/alerting_example/public/components/create_alert.tsx b/x-pack/examples/alerting_example/public/components/create_alert.tsx index 8177763ca5fe8..889b0c7f2d7d6 100644 --- a/x-pack/examples/alerting_example/public/components/create_alert.tsx +++ b/x-pack/examples/alerting_example/public/components/create_alert.tsx @@ -36,8 +36,8 @@ export const CreateAlert = ({ } - title={`Create Alert`} - description="Create an new Alert based on one of our example Alert Types ." + title={`Create Rule`} + description="Create a new Rule based on one of our example Rule Types ." onClick={() => setAlertFlyoutVisibility(true)} /> diff --git a/x-pack/examples/alerting_example/public/components/documentation.tsx b/x-pack/examples/alerting_example/public/components/documentation.tsx index 3bfe4697253c3..2cef174675533 100644 --- a/x-pack/examples/alerting_example/public/components/documentation.tsx +++ b/x-pack/examples/alerting_example/public/components/documentation.tsx @@ -46,8 +46,8 @@ export const DocumentationPage = (

Plugin Structure

This example solution has both `server` and a `public` plugins. The `server` handles - registration of example the AlertTypes, while the `public` handles creation of, and - navigation for, these alert types. + registration of example the RuleTypes, while the `public` handles creation of, and + navigation for, these rule types.

diff --git a/x-pack/examples/alerting_example/public/components/view_alert.tsx b/x-pack/examples/alerting_example/public/components/view_alert.tsx index 12f0eb6f35701..8c942d685af27 100644 --- a/x-pack/examples/alerting_example/public/components/view_alert.tsx +++ b/x-pack/examples/alerting_example/public/components/view_alert.tsx @@ -43,37 +43,37 @@ export const ViewAlertPage = withRouter(({ http, id }: Props) => { return alert && alertState ? ( - +

- This is a generic view for all Alerts created by the + This is a generic view for all Rules created by the {ALERTING_EXAMPLE_APP_ID} plugin.

You are now viewing the {`${alert.name}`} - Alert, whose ID is {`${alert.id}`}. + Rule, whose ID is {`${alert.id}`}.

- Its AlertType is {`${alert.alertTypeId}`} and + Its RuleType is {`${alert.alertTypeId}`} and its scheduled to run at an interval of {`${alert.schedule.interval}`}.

-

Alert Instances

+

Alerts

 {isEmpty(alertState.alertInstances) ? ( - -

This Alert doesn't have any active alert instances at the moment.

+ +

This Rule doesn't have any active alerts at the moment.

 ) : (

- Bellow are the active Alert Instances which were activated on the alerts last run. + Below are the active Alerts which were activated on the rules last run.
- For each instance id you can see its current state in JSON format. + For each alert id you can see its current state in JSON format.

diff --git a/x-pack/examples/alerting_example/public/components/view_astros_alert.tsx b/x-pack/examples/alerting_example/public/components/view_astros_alert.tsx index 1d8bf4e3a71dd..7e8487b0179fa 100644 --- a/x-pack/examples/alerting_example/public/components/view_astros_alert.tsx +++ b/x-pack/examples/alerting_example/public/components/view_astros_alert.tsx @@ -49,21 +49,20 @@ export const ViewPeopleInSpaceAlertPage = withRouter(({ http, id }: Props) => { return alert && alertState ? ( - +

This is a specific view for all - example.people-in-space Alerts created by - the + example.people-in-space Rules created by the {ALERTING_EXAMPLE_APP_ID} plugin.

-

Alert Instances

+

Alerts

 {isEmpty(alertState.alertInstances) ? ( - +

The people in {alert.params.craft} at the moment are not {alert.params.op}{' '} {alert.params.outerSpaceCapacity} @@ -73,7 +72,7 @@ export const ViewPeopleInSpaceAlertPage = withRouter(({ http, id }: Props) => {

- The alert has been triggered because the people in {alert.params.craft} at the moment{' '} + The rule has been triggered because the people in {alert.params.craft} at the moment{' '} {alert.params.op} {alert.params.outerSpaceCapacity}

diff --git a/x-pack/examples/alerting_example/public/plugin.tsx b/x-pack/examples/alerting_example/public/plugin.tsx index c8f69b21b4ee4..6ec6f043d0e0e 100644 --- a/x-pack/examples/alerting_example/public/plugin.tsx +++ b/x-pack/examples/alerting_example/public/plugin.tsx @@ -63,7 +63,7 @@ export class AlertingExamplePlugin implements Plugin { export const App = ({ deps }: { deps: TriggersAndActionsUiServices }) => { const { savedObjects, uiSettings } = deps; - const sections: Section[] = ['alerts', 'connectors']; + const sections: Section[] = ['rules', 'connectors']; const isDarkMode = useObservable(uiSettings.get$('theme:darkMode')); const sectionsRegex = sections.join('|'); @@ -81,10 +81,16 @@ export const AppWithoutRouter = ({ sectionsRegex }: { sectionsRegex: string }) = component={suspendedComponentWithProps(TriggersActionsUIHome, 'xl')} /> - + } + /> + + ); }; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/add_message_variables.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/add_message_variables.tsx index 87a76bb127eb3..bf89e4f6ae6e1 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/components/add_message_variables.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/components/add_message_variables.tsx @@ -55,9 +55,9 @@ export const AddMessageVariables: React.FunctionComponent = ({ )); const addVariableButtonTitle = i18n.translate( - 'xpack.triggersActionsUI.components.addMessageVariables.addVariableTitle', + 'xpack.triggersActionsUI.components.addMessageVariables.addRuleVariableTitle', { - defaultMessage: 'Add alert variable', + defaultMessage: 'Add rule variable', } ); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/health_check.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/health_check.test.tsx index 22cb126268a72..3baf4e33fb68d 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/components/health_check.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/components/health_check.test.tsx @@ -127,7 +127,7 @@ describe('health check', () => { const description = queryByRole(/banner/i); expect(description!.textContent).toMatchInlineSnapshot( - `"To create an alert, set a value for xpack.encryptedSavedObjects.encryptionKey in your kibana.yml file and ensure the Encrypted Saved Objects plugin is enabled. Learn how.(opens in a new tab or window)"` + `"To create a rule, set a value for xpack.encryptedSavedObjects.encryptionKey in your kibana.yml file and ensure the Encrypted Saved Objects plugin is enabled. Learn how.(opens in a new tab or window)"` ); const action = queryByText(/Learn/i); @@ -158,11 +158,11 @@ describe('health check', () => { const description = queryByText(/Transport Layer Security/i); expect(description!.textContent).toMatchInlineSnapshot( - `"You must enable Transport Layer Security between Kibana and Elasticsearch and configure an encryption key in your kibana.yml file. Learn how(opens in a new tab or window)"` + `"You must enable Transport Layer Security between Kibana and Elasticsearch and configure an encryption key in your kibana.yml file. Learn how.(opens in a new tab or window)"` ); const action = queryByText(/Learn/i); - expect(action!.textContent).toMatchInlineSnapshot(`"Learn how(opens in a new tab or window)"`); + expect(action!.textContent).toMatchInlineSnapshot(`"Learn how.(opens in a new tab or window)"`); expect(action!.getAttribute('href')).toMatchInlineSnapshot( `"https://www.elastic.co/guide/en/kibana/mocked-test-branch/alerting-getting-started.html#alerting-setup-prerequisites"` ); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/health_check.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/health_check.tsx index ffd6739282a3b..208fd5ec66f1d 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/components/health_check.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/components/health_check.tsx @@ -118,7 +118,7 @@ const EncryptionError = ({ docLinks, className }: PromptErrorProps) => ( {i18n.translate( 'xpack.triggersActionsUI.components.healthCheck.encryptionErrorBeforeKey', { - defaultMessage: 'To create an alert, set a value for ', + defaultMessage: 'To create a rule, set a value for ', } )} {'xpack.encryptedSavedObjects.encryptionKey'} @@ -185,7 +185,7 @@ const AlertsError = ({ docLinks, className }: PromptErrorProps) => (

} @@ -193,11 +193,11 @@ const AlertsError = ({ docLinks, className }: PromptErrorProps) => (

{i18n.translate('xpack.triggersActionsUI.components.healthCheck.alertsError', { - defaultMessage: 'To create an alert, set alerts and actions plugins enabled. ', + defaultMessage: 'To create a rule, you must enable the alerting and actions plugins. ', })} {i18n.translate('xpack.triggersActionsUI.components.healthCheck.alertsErrorAction', { - defaultMessage: 'Learn how to enable Alerts and Actions.', + defaultMessage: 'Learn how.', })}

@@ -231,7 +231,7 @@ const TlsAndEncryptionError = ({ docLinks, className }: PromptErrorProps) => ( {i18n.translate( 'xpack.triggersActionsUI.components.healthCheck.tlsAndEncryptionErrorAction', { - defaultMessage: 'Learn how', + defaultMessage: 'Learn how.', } )} diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/prompts/empty_connectors_prompt.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/prompts/empty_connectors_prompt.tsx index 2f319fcaa01df..e56fad409d98f 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/components/prompts/empty_connectors_prompt.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/components/prompts/empty_connectors_prompt.tsx @@ -22,7 +22,7 @@ export const EmptyConnectorsPrompt = ({ onCTAClicked }: { onCTAClicked: () => vo

@@ -32,7 +32,7 @@ export const EmptyConnectorsPrompt = ({ onCTAClicked }: { onCTAClicked: () => vo body={

@@ -47,7 +47,7 @@ export const EmptyConnectorsPrompt = ({ onCTAClicked }: { onCTAClicked: () => vo onClick={onCTAClicked} > diff --git a/x-pack/plugins/triggers_actions_ui/public/application/components/prompts/empty_prompt.tsx b/x-pack/plugins/triggers_actions_ui/public/application/components/prompts/empty_prompt.tsx index 8f94d1ac93106..39187ccb14cd8 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/components/prompts/empty_prompt.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/components/prompts/empty_prompt.tsx @@ -17,7 +17,7 @@ export const EmptyPrompt = ({ onCTAClicked }: { onCTAClicked: () => void }) => (

} @@ -38,7 +38,7 @@ export const EmptyPrompt = ({ onCTAClicked }: { onCTAClicked: () => void }) => ( > } diff --git a/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts b/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts index e5db5a45975af..2d0b2e99c10a6 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/constants/index.ts @@ -10,12 +10,14 @@ import { i18n } from '@kbn/i18n'; export { BASE_ALERT_API_PATH } from '../../../../alerting/common'; export { BASE_ACTION_API_PATH } from '../../../../actions/common'; -export type Section = 'connectors' | 'alerts'; +export type Section = 'connectors' | 'rules'; export const routeToHome = `/`; export const routeToConnectors = `/connectors`; -export const routeToAlerts = `/alerts`; -export const routeToAlertDetails = `/alert/:alertId`; +export const routeToRules = `/rules`; +export const routeToRuleDetails = `/rule/:ruleId`; +export const legacyRouteToRules = `/alerts`; +export const legacyRouteToRuleDetails = `/alert/:alertId`; export const recoveredActionGroupMessage = i18n.translate( 'xpack.triggersActionsUI.sections.actionForm.RecoveredMessage', diff --git a/x-pack/plugins/triggers_actions_ui/public/application/constants/plugin.ts b/x-pack/plugins/triggers_actions_ui/public/application/constants/plugin.ts index 169787fc28294..bf5cf6d58c69c 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/constants/plugin.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/constants/plugin.ts @@ -9,7 +9,7 @@ export const PLUGIN = { ID: 'triggersActionsUi', getI18nName: (i18n: any): string => { return i18n.translate('xpack.triggersActionsUI.appName', { - defaultMessage: 'Alerts and Actions', + defaultMessage: 'Rules and Connectors', }); }, }; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/home.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/home.test.tsx index a265adfecf55f..3d71d5404da2b 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/home.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/home.test.tsx @@ -21,10 +21,10 @@ describe('home', () => { location: createLocation('/'), match: { isExact: true, - path: `/alerts`, + path: `/rules`, url: '', params: { - section: 'alerts', + section: 'rules', }, }, }; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/home.tsx b/x-pack/plugins/triggers_actions_ui/public/application/home.tsx index c251a1d597f27..b77593c990550 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/home.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/home.tsx @@ -21,7 +21,7 @@ import { EuiFlexItem, } from '@elastic/eui'; -import { Section, routeToConnectors, routeToAlerts } from './constants'; +import { Section, routeToConnectors, routeToRules } from './constants'; import { getAlertingSectionBreadcrumb } from './lib/breadcrumb'; import { getCurrentDocTitle } from './lib/doc_title'; import { hasShowActionsCapability } from './lib/capabilities'; @@ -56,9 +56,9 @@ export const TriggersActionsUIHome: React.FunctionComponent = []; tabs.push({ - id: 'alerts', + id: 'rules', name: ( - + ), }); @@ -93,7 +93,7 @@ export const TriggersActionsUIHome: React.FunctionComponent @@ -105,7 +105,7 @@ export const TriggersActionsUIHome: React.FunctionComponent @@ -117,7 +117,7 @@ export const TriggersActionsUIHome: React.FunctionComponent

@@ -153,7 +153,7 @@ export const TriggersActionsUIHome: React.FunctionComponent ( diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.test.ts index 5186318194be7..4dbda8f5d9614 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.test.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.test.ts @@ -7,7 +7,7 @@ import { getAlertingSectionBreadcrumb, getAlertDetailsBreadcrumb } from './breadcrumb'; import { i18n } from '@kbn/i18n'; -import { routeToConnectors, routeToAlerts, routeToHome } from '../constants'; +import { routeToConnectors, routeToRules, routeToHome } from '../constants'; describe('getAlertingSectionBreadcrumb', () => { test('if change calls return proper breadcrumb title ', async () => { @@ -17,15 +17,15 @@ describe('getAlertingSectionBreadcrumb', () => { }), href: `${routeToConnectors}`, }); - expect(getAlertingSectionBreadcrumb('alerts')).toMatchObject({ - text: i18n.translate('xpack.triggersActionsUI.alerts.breadcrumbTitle', { - defaultMessage: 'Alerts', + expect(getAlertingSectionBreadcrumb('rules')).toMatchObject({ + text: i18n.translate('xpack.triggersActionsUI.rules.breadcrumbTitle', { + defaultMessage: 'Rules', }), - href: `${routeToAlerts}`, + href: `${routeToRules}`, }); expect(getAlertingSectionBreadcrumb('home')).toMatchObject({ text: i18n.translate('xpack.triggersActionsUI.home.breadcrumbTitle', { - defaultMessage: 'Alerts and Actions', + defaultMessage: 'Rules and Connectors', }), href: `${routeToHome}`, }); @@ -38,7 +38,7 @@ describe('getAlertDetailsBreadcrumb', () => { text: i18n.translate('xpack.triggersActionsUI.alertDetails.breadcrumbTitle', { defaultMessage: 'testName', }), - href: '/alert/testId', + href: '/rule/testId', }); }); }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.ts index a91a9c19a0b67..b98aac8719d32 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/breadcrumb.ts @@ -6,7 +6,7 @@ */ import { i18n } from '@kbn/i18n'; -import { routeToHome, routeToConnectors, routeToAlerts, routeToAlertDetails } from '../constants'; +import { routeToHome, routeToConnectors, routeToRules, routeToRuleDetails } from '../constants'; export const getAlertingSectionBreadcrumb = (type: string): { text: string; href: string } => { // Home and sections @@ -18,17 +18,17 @@ export const getAlertingSectionBreadcrumb = (type: string): { text: string; href }), href: `${routeToConnectors}`, }; - case 'alerts': + case 'rules': return { - text: i18n.translate('xpack.triggersActionsUI.alerts.breadcrumbTitle', { - defaultMessage: 'Alerts', + text: i18n.translate('xpack.triggersActionsUI.rules.breadcrumbTitle', { + defaultMessage: 'Rules', }), - href: `${routeToAlerts}`, + href: `${routeToRules}`, }; default: return { text: i18n.translate('xpack.triggersActionsUI.home.breadcrumbTitle', { - defaultMessage: 'Alerts and Actions', + defaultMessage: 'Rules and Connectors', }), href: `${routeToHome}`, }; @@ -41,6 +41,6 @@ export const getAlertDetailsBreadcrumb = ( ): { text: string; href: string } => { return { text: name, - href: `${routeToAlertDetails.replace(':alertId', id)}`, + href: `${routeToRuleDetails.replace(':ruleId', id)}`, }; }; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/check_alert_type_enabled.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/lib/check_alert_type_enabled.test.tsx index a232ead01f81d..44cb17262fb57 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/lib/check_alert_type_enabled.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/check_alert_type_enabled.test.tsx @@ -61,7 +61,7 @@ describe('checkAlertTypeEnabled', () => { expect(checkAlertTypeEnabled(alertType)).toMatchInlineSnapshot(` Object { "isEnabled": false, - "message": "This alert type requires a Gold license.", + "message": "This rule type requires a Gold license.", } `); }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/check_alert_type_enabled.tsx b/x-pack/plugins/triggers_actions_ui/public/application/lib/check_alert_type_enabled.tsx index 9f030d64a8592..9348b367aee9b 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/lib/check_alert_type_enabled.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/check_alert_type_enabled.tsx @@ -21,9 +21,9 @@ const getLicenseCheckResult = (alertType: AlertType) => { return { isEnabled: false, message: i18n.translate( - 'xpack.triggersActionsUI.checkAlertTypeEnabled.alertTypeDisabledByLicenseMessage', + 'xpack.triggersActionsUI.checkAlertTypeEnabled.ruleTypeDisabledByLicenseMessage', { - defaultMessage: 'This alert type requires a {minimumLicenseRequired} license.', + defaultMessage: 'This rule type requires a {minimumLicenseRequired} license.', values: { minimumLicenseRequired: upperFirst(alertType.minimumLicenseRequired), }, diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.test.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.test.ts index f8ce5c87f3c37..af352de0cc6e7 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.test.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.test.ts @@ -9,8 +9,8 @@ import { getCurrentDocTitle } from './doc_title'; describe('getCurrentDocTitle', () => { test('if change calls return the proper doc title ', async () => { - expect(getCurrentDocTitle('home') === 'Alerts and Actions').toBeTruthy(); + expect(getCurrentDocTitle('home') === 'Rules and Connectors').toBeTruthy(); expect(getCurrentDocTitle('connectors') === 'Connectors').toBeTruthy(); - expect(getCurrentDocTitle('alerts') === 'Alerts').toBeTruthy(); + expect(getCurrentDocTitle('rules') === 'Rules').toBeTruthy(); }); }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.ts b/x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.ts index 4b3c251b35a75..fab9e19c8acee 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/doc_title.ts @@ -16,14 +16,14 @@ export const getCurrentDocTitle = (page: string): string => { defaultMessage: 'Connectors', }); break; - case 'alerts': - updatedTitle = i18n.translate('xpack.triggersActionsUI.alerts.breadcrumbTitle', { - defaultMessage: 'Alerts', + case 'rules': + updatedTitle = i18n.translate('xpack.triggersActionsUI.rules.breadcrumbTitle', { + defaultMessage: 'Rules', }); break; default: updatedTitle = i18n.translate('xpack.triggersActionsUI.home.breadcrumbTitle', { - defaultMessage: 'Alerts and Actions', + defaultMessage: 'Rules and Connectors', }); } return updatedTitle; diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx index ae77a3bdde891..e8176d752555c 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_connector_form.tsx @@ -140,9 +140,9 @@ export const ActionConnectorForm = ({

@@ -417,8 +417,8 @@ export const ActionForm = ({ className="actActionForm__getMoreActionsLink" > @@ -431,8 +431,8 @@ export const ActionForm = ({ {isLoadingActionTypes ? ( ) : ( diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.tsx index 7601df9b498e6..4428d635c6493 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/action_type_menu.tsx @@ -75,8 +75,8 @@ export const ActionTypeMenu = ({ if (toasts) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.actionsConnectorsList.unableToLoadActionTypesMessage', - { defaultMessage: 'Unable to load action types' } + 'xpack.triggersActionsUI.sections.actionsConnectorsList.unableToLoadConnectorTypesMessage', + { defaultMessage: 'Unable to load connector types' } ), }); } diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/test_connector_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/test_connector_form.tsx index c4ace3dc560b6..8afa2d2b57529 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/test_connector_form.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/action_connector_form/test_connector_form.tsx @@ -54,7 +54,12 @@ export const TestConnectorForm = ({ const steps = [ { - title: 'Create an action', + title: i18n.translate( + 'xpack.triggersActionsUI.sections.testConnectorForm.createActionHeader', + { + defaultMessage: 'Create an action', + } + ), children: ParamsFieldsComponent ? ( ) : ( -

This Connector does not require any Action Parameter.

+

+ +

), }, { - title: 'Run the action', + title: i18n.translate('xpack.triggersActionsUI.sections.testConnectorForm.runTestHeader', { + defaultMessage: 'Run the test', + }), children: ( {executeEnabled ? null : ( @@ -122,7 +134,12 @@ export const TestConnectorForm = ({ ), }, { - title: 'Results', + title: i18n.translate( + 'xpack.triggersActionsUI.sections.testConnectorForm.testResultsHeader', + { + defaultMessage: 'Results', + } + ), children: pipe( executionResult, map((result) => @@ -144,7 +161,7 @@ const AwaitingExecution = () => (

@@ -156,7 +173,7 @@ const SuccessfulExecution = () => ( title={i18n.translate( 'xpack.triggersActionsUI.sections.testConnectorForm.executionSuccessfulTitle', { - defaultMessage: 'Action was successful', + defaultMessage: 'Test was successful', values: {}, } )} @@ -212,7 +229,7 @@ const FailedExecussion = ({ title={i18n.translate( 'xpack.triggersActionsUI.sections.testConnectorForm.executionFailureTitle', { - defaultMessage: 'Action failed to run', + defaultMessage: 'Test failed to run', } )} data-test-subj="executionFailureResult" diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx index 1555cc9b03b5d..d80041312d790 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/actions_connectors_list/components/actions_connectors_list.tsx @@ -84,8 +84,8 @@ export const ActionsConnectorsList: React.FunctionComponent = () => { } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.actionsConnectorsList.unableToLoadActionTypesMessage', - { defaultMessage: 'Unable to load action types' } + 'xpack.triggersActionsUI.sections.actionsConnectorsList.unableToLoadConnectorTypesMessage', + { defaultMessage: 'Unable to load connector types' } ), }); } finally { diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx index d425566d8f3df..0796f09b13460 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details.tsx @@ -5,6 +5,7 @@ * 2.0. */ +import { i18n } from '@kbn/i18n'; import React, { useState, Fragment, useEffect, useReducer } from 'react'; import { keyBy } from 'lodash'; import { useHistory } from 'react-router-dom'; @@ -39,7 +40,7 @@ import { import { AlertInstancesRouteWithApi } from './alert_instances_route'; import { ViewInApp } from './view_in_app'; import { AlertEdit } from '../../alert_form'; -import { routeToAlertDetails } from '../../../constants'; +import { routeToRuleDetails } from '../../../constants'; import { alertsErrorReasonTranslationsMapping } from '../../alerts_list/translations'; import { useKibana } from '../../../../common/lib/kibana'; import { alertReducer } from '../../alert_form/alert_reducer'; @@ -108,7 +109,7 @@ export const AlertDetails: React.FunctionComponent = ({ const [dissmissAlertErrors, setDissmissAlertErrors] = useState(false); const setAlert = async () => { - history.push(routeToAlertDetails.replace(`:alertId`, alert.id)); + history.push(routeToRuleDetails.replace(`:ruleId`, alert.id)); }; const getAlertStatusErrorReasonText = () => { @@ -331,11 +332,20 @@ export const AlertDetails: React.FunctionComponent = ({ ) : ( - +

diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.test.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.test.tsx index e9f961487f4a9..41c70a6737fa0 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.test.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.test.tsx @@ -146,7 +146,7 @@ describe('getAlertData useEffect handler', () => { ); expect(toastNotifications.addDanger).toHaveBeenCalledTimes(1); expect(toastNotifications.addDanger).toHaveBeenCalledWith({ - title: 'Unable to load alert: OMG', + title: 'Unable to load rule: OMG', }); }); @@ -192,7 +192,7 @@ describe('getAlertData useEffect handler', () => { ); expect(toastNotifications.addDanger).toHaveBeenCalledTimes(1); expect(toastNotifications.addDanger).toHaveBeenCalledWith({ - title: 'Unable to load alert: OMG no alert type', + title: 'Unable to load rule: OMG no alert type', }); }); @@ -242,7 +242,7 @@ describe('getAlertData useEffect handler', () => { ); expect(toastNotifications.addDanger).toHaveBeenCalledTimes(1); expect(toastNotifications.addDanger).toHaveBeenCalledWith({ - title: 'Unable to load alert: OMG no action type', + title: 'Unable to load rule: OMG no action type', }); }); @@ -290,7 +290,7 @@ describe('getAlertData useEffect handler', () => { ); expect(toastNotifications.addDanger).toHaveBeenCalledTimes(1); expect(toastNotifications.addDanger).toHaveBeenCalledWith({ - title: `Unable to load alert: Invalid Alert Type: ${alert.alertTypeId}`, + title: `Unable to load rule: Invalid Alert Type: ${alert.alertTypeId}`, }); }); @@ -349,7 +349,7 @@ describe('getAlertData useEffect handler', () => { ); expect(toastNotifications.addDanger).toHaveBeenCalledTimes(1); expect(toastNotifications.addDanger).toHaveBeenCalledWith({ - title: `Unable to load alert: Invalid Action Type: ${missingActionType.id}`, + title: `Unable to load rule: Invalid Action Type: ${missingActionType.id}`, }); }); }); @@ -374,12 +374,12 @@ function mockRouterProps(alert: Alert) { return { match: { isExact: false, - path: `/alert/${alert.id}`, + path: `/rule/${alert.id}`, url: '', - params: { alertId: alert.id }, + params: { ruleId: alert.id }, }, history: createMemoryHistory(), - location: createLocation(`/alert/${alert.id}`), + location: createLocation(`/rule/${alert.id}`), }; } function mockAlert(overloads: Partial = {}): Alert { diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.tsx index 445e8fa06e7ff..2d6db5f6330cc 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_details_route.tsx @@ -24,14 +24,14 @@ import { useKibana } from '../../../../common/lib/kibana'; import { CenterJustifiedSpinner } from '../../../components/center_justified_spinner'; type AlertDetailsRouteProps = RouteComponentProps<{ - alertId: string; + ruleId: string; }> & Pick & Pick; export const AlertDetailsRoute: React.FunctionComponent = ({ match: { - params: { alertId }, + params: { ruleId }, }, loadAlert, loadAlertTypes, @@ -48,7 +48,7 @@ export const AlertDetailsRoute: React.FunctionComponent const [refreshToken, requestRefresh] = React.useState(); useEffect(() => { getAlertData( - alertId, + ruleId, loadAlert, loadAlertTypes, loadActionTypes, @@ -57,7 +57,7 @@ export const AlertDetailsRoute: React.FunctionComponent setActionTypes, toasts ); - }, [alertId, http, loadActionTypes, loadAlert, loadAlertTypes, toasts, refreshToken]); + }, [ruleId, http, loadActionTypes, loadAlert, loadAlertTypes, toasts, refreshToken]); return alert && alertType && actionTypes ? ( { ); expect(toastNotifications.addDanger).toHaveBeenCalledTimes(1); expect(toastNotifications.addDanger).toHaveBeenCalledWith({ - title: 'Unable to load alert instance summary: OMG', + title: 'Unable to load alerts: OMG', }); }); }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.tsx index cf5e3e4577977..713e8e8b6cc95 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_details/components/alert_instances_route.tsx @@ -69,9 +69,9 @@ export async function getAlertInstanceSummary( } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertDetails.unableToLoadAlertInstanceSummaryMessage', + 'xpack.triggersActionsUI.sections.alertDetails.unableToLoadAlertsMessage', { - defaultMessage: 'Unable to load alert instance summary: {message}', + defaultMessage: 'Unable to load alerts: {message}', values: { message: e.message, }, diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.tsx index 90fb96b81a775..bcae77f896b71 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_add.tsx @@ -154,9 +154,9 @@ const AlertAdd = ({ const newAlert = await createAlert({ http, alert: alert as AlertUpdates }); toasts.addSuccess( i18n.translate('xpack.triggersActionsUI.sections.alertAdd.saveSuccessNotificationText', { - defaultMessage: 'Created alert "{alertName}"', + defaultMessage: 'Created rule "{ruleName}"', values: { - alertName: newAlert.name, + ruleName: newAlert.name, }, }) ); @@ -165,7 +165,7 @@ const AlertAdd = ({ toasts.addDanger( errorRes.body?.message ?? i18n.translate('xpack.triggersActionsUI.sections.alertAdd.saveErrorNotificationText', { - defaultMessage: 'Cannot create alert.', + defaultMessage: 'Cannot create rule.', }) ); } @@ -183,7 +183,7 @@ const AlertAdd = ({

diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_edit.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_edit.tsx index 20761c5760be3..d704111858e4f 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_edit.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_edit.tsx @@ -100,9 +100,9 @@ export const AlertEdit = ({ const newAlert = await updateAlert({ http, alert, id: alert.id }); toasts.addSuccess( i18n.translate('xpack.triggersActionsUI.sections.alertEdit.saveSuccessNotificationText', { - defaultMessage: "Updated '{alertName}'", + defaultMessage: "Updated '{ruleName}'", values: { - alertName: newAlert.name, + ruleName: newAlert.name, }, }) ); @@ -121,7 +121,7 @@ export const AlertEdit = ({ toasts.addDanger( errorRes.body?.message ?? i18n.translate('xpack.triggersActionsUI.sections.alertEdit.saveErrorNotificationText', { - defaultMessage: 'Cannot update alert.', + defaultMessage: 'Cannot update rule.', }) ); } @@ -139,7 +139,7 @@ export const AlertEdit = ({

@@ -157,7 +157,7 @@ export const AlertEdit = ({ data-test-subj="hasActionsDisabled" title={i18n.translate( 'xpack.triggersActionsUI.sections.alertEdit.disabledActionsWarningTitle', - { defaultMessage: 'This alert has actions that are disabled' } + { defaultMessage: 'This rule has actions that are disabled' } )} /> diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx index 7756f9e92a2cb..fdf398003ab03 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_form.tsx @@ -102,8 +102,8 @@ export function validateBaseProperties(alertObject: InitialAlert): ValidationRes } if (!alertObject.alertTypeId) { errors.alertTypeId.push( - i18n.translate('xpack.triggersActionsUI.sections.alertForm.error.requiredAlertTypeIdText', { - defaultMessage: 'Alert type is required.', + i18n.translate('xpack.triggersActionsUI.sections.alertForm.error.requiredRuleTypeIdText', { + defaultMessage: 'Rule type is required.', }) ); } @@ -113,7 +113,7 @@ export function validateBaseProperties(alertObject: InitialAlert): ValidationRes if (emptyConnectorActions !== undefined) { errors.actionConnectors.push( i18n.translate('xpack.triggersActionsUI.sections.alertForm.error.requiredActionConnector', { - defaultMessage: 'Action connector for {actionTypeId} is required.', + defaultMessage: 'Action for {actionTypeId} connector is required.', values: { actionTypeId: emptyConnectorActions.actionTypeId }, }) ); @@ -277,8 +277,8 @@ export const AlertForm = ({ } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertForm.unableToLoadAlertTypesMessage', - { defaultMessage: 'Unable to load alert types' } + 'xpack.triggersActionsUI.sections.alertForm.unableToLoadRuleTypesMessage', + { defaultMessage: 'Unable to load rule types' } ), }); } @@ -581,8 +581,8 @@ export const AlertForm = ({ fallback={ } @@ -815,8 +815,8 @@ export const AlertForm = ({ className="actActionForm__getMoreActionsLink" > @@ -826,8 +826,8 @@ export const AlertForm = ({
@@ -876,8 +876,8 @@ export const AlertForm = ({ ) : ( )} @@ -893,8 +893,8 @@ const NoAuthorizedAlertTypes = ({ operation }: { operation: string }) => ( title={

@@ -903,8 +903,8 @@ const NoAuthorizedAlertTypes = ({ operation }: { operation: string }) => (

diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_notify_when.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_notify_when.tsx index ee0f1c4c0ceb8..95fbe9c6ae614 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_notify_when.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/alert_notify_when.tsx @@ -49,7 +49,7 @@ const NOTIFY_WHEN_OPTIONS: Array> = [

@@ -62,7 +62,7 @@ const NOTIFY_WHEN_OPTIONS: Array> = [ inputDisplay: i18n.translate( 'xpack.triggersActionsUI.sections.alertForm.alertNotifyWhen.onActiveAlert.display', { - defaultMessage: 'Every time alert is active', + defaultMessage: 'Every time rule is active', } ), 'data-test-subj': 'onActiveAlert', @@ -70,14 +70,14 @@ const NOTIFY_WHEN_OPTIONS: Array> = [

@@ -166,7 +166,7 @@ export const AlertNotifyWhen = ({ position="right" type="questionInCircle" content={i18n.translate('xpack.triggersActionsUI.sections.alertForm.renotifyWithTooltip', { - defaultMessage: 'Define how often to repeat the action while the alert is active.', + defaultMessage: 'Define how often to repeat the action while the rule is active.', })} /> diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/confirm_alert_close.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/confirm_alert_close.tsx index 6d71fe858f1c1..df54ecb921156 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/confirm_alert_close.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/confirm_alert_close.tsx @@ -21,7 +21,7 @@ export const ConfirmAlertClose: React.FC = ({ onConfirm, onCancel }) => { title={i18n.translate( 'xpack.triggersActionsUI.sections.confirmAlertClose.confirmAlertCloseTitle', { - defaultMessage: 'Discard unsaved changes to alert?', + defaultMessage: 'Discard unsaved changes to rule?', } )} onCancel={onCancel} diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/confirm_alert_save.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/confirm_alert_save.tsx index c406ec7c80283..f81293293f557 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/confirm_alert_save.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alert_form/confirm_alert_save.tsx @@ -21,7 +21,7 @@ export const ConfirmAlertSave: React.FC = ({ onConfirm, onCancel }) => { title={i18n.translate( 'xpack.triggersActionsUI.sections.confirmAlertSave.confirmAlertSaveTitle', { - defaultMessage: 'Save Alert with no actions?', + defaultMessage: 'Save rule with no actions?', } )} onCancel={onCancel} @@ -29,7 +29,7 @@ export const ConfirmAlertSave: React.FC = ({ onConfirm, onCancel }) => { confirmButtonText={i18n.translate( 'xpack.triggersActionsUI.sections.confirmAlertSave.confirmAlertSaveConfirmButtonText', { - defaultMessage: 'Save alert', + defaultMessage: 'Save rule', } )} cancelButtonText={i18n.translate( diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx index 65ef771157ee5..d43dd9f05344f 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/alerts_list.tsx @@ -47,7 +47,7 @@ import { } from '../../../lib/alert_api'; import { loadActionTypes } from '../../../lib/action_connector_api'; import { hasExecuteActionsCapability } from '../../../lib/capabilities'; -import { routeToAlertDetails, DEFAULT_SEARCH_PAGE_SIZE } from '../../../constants'; +import { routeToRuleDetails, DEFAULT_SEARCH_PAGE_SIZE } from '../../../constants'; import { DeleteModalConfirmation } from '../../../components/delete_modal_confirmation'; import { EmptyPrompt } from '../../../components/prompts/empty_prompt'; import { @@ -154,8 +154,8 @@ export const AlertsList: React.FunctionComponent = () => { } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertsList.unableToLoadAlertTypesMessage', - { defaultMessage: 'Unable to load alert types' } + 'xpack.triggersActionsUI.sections.alertsList.unableToLoadRuleTypesMessage', + { defaultMessage: 'Unable to load rule types' } ), }); setAlertTypesState({ ...alertTypesState, isLoading: false }); @@ -179,8 +179,8 @@ export const AlertsList: React.FunctionComponent = () => { } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertsList.unableToLoadActionTypesMessage', - { defaultMessage: 'Unable to load action types' } + 'xpack.triggersActionsUI.sections.alertsList.unableToLoadConnectorTypesMessage', + { defaultMessage: 'Unable to load connector types' } ), }); } @@ -214,9 +214,9 @@ export const AlertsList: React.FunctionComponent = () => { } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertsList.unableToLoadAlertsMessage', + 'xpack.triggersActionsUI.sections.alertsList.unableToLoadRulesMessage', { - defaultMessage: 'Unable to load alerts', + defaultMessage: 'Unable to load rules', } ), }); @@ -240,9 +240,9 @@ export const AlertsList: React.FunctionComponent = () => { } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertsList.unableToLoadAlertsStatusesInfoMessage', + 'xpack.triggersActionsUI.sections.alertsList.unableToLoadRuleStatusInfoMessage', { - defaultMessage: 'Unable to load alert statuses info', + defaultMessage: 'Unable to load rule status info', } ), }); @@ -322,7 +322,7 @@ export const AlertsList: React.FunctionComponent = () => { { - history.push(routeToAlertDetails.replace(`:alertId`, alert.id)); + history.push(routeToRuleDetails.replace(`:ruleId`, alert.id)); }} > {name} @@ -509,8 +509,8 @@ export const AlertsList: React.FunctionComponent = () => { onClick={() => setAlertFlyoutVisibility(true)} > @@ -552,7 +552,7 @@ export const AlertsList: React.FunctionComponent = () => { title={ { { apiDeleteCall={deleteAlerts} idsToDelete={alertsToDelete} singleTitle={i18n.translate('xpack.triggersActionsUI.sections.alertsList.singleTitle', { - defaultMessage: 'alert', + defaultMessage: 'rule', })} multipleTitle={i18n.translate('xpack.triggersActionsUI.sections.alertsList.multipleTitle', { - defaultMessage: 'alerts', + defaultMessage: 'rules', })} setIsLoadingState={(isLoading: boolean) => { setAlertsState({ ...alertsState, isLoading }); @@ -789,7 +789,7 @@ const noPermissionPrompt = (

} diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/collapsed_item_actions.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/collapsed_item_actions.tsx index 652fa27867770..b5458ee4cb54f 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/collapsed_item_actions.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/collapsed_item_actions.tsx @@ -92,7 +92,7 @@ export const CollapsedItemActions: React.FunctionComponent = ({
@@ -122,7 +122,7 @@ export const CollapsedItemActions: React.FunctionComponent = ({
diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/manage_license_modal.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/manage_license_modal.tsx index 4a5739c8b4430..ba1e19959d883 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/manage_license_modal.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/components/manage_license_modal.tsx @@ -51,7 +51,7 @@ export const ManageLicenseModal: React.FC = ({

diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/translations.ts b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/translations.ts index 1a2c576b1fa28..95322fa0d0bcf 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/translations.ts +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/alerts_list/translations.ts @@ -67,28 +67,28 @@ export const ALERT_ERROR_UNKNOWN_REASON = i18n.translate( export const ALERT_ERROR_READING_REASON = i18n.translate( 'xpack.triggersActionsUI.sections.alertsList.alertErrorReasonReading', { - defaultMessage: 'An error occurred when reading the alert.', + defaultMessage: 'An error occurred when reading the rule.', } ); export const ALERT_ERROR_DECRYPTING_REASON = i18n.translate( 'xpack.triggersActionsUI.sections.alertsList.alertErrorReasonDecrypting', { - defaultMessage: 'An error occurred when decrypting the alert.', + defaultMessage: 'An error occurred when decrypting the rule.', } ); export const ALERT_ERROR_EXECUTION_REASON = i18n.translate( 'xpack.triggersActionsUI.sections.alertsList.alertErrorReasonRunning', { - defaultMessage: 'An error occurred when running the alert.', + defaultMessage: 'An error occurred when running the rule.', } ); export const ALERT_ERROR_LICENSE_REASON = i18n.translate( 'xpack.triggersActionsUI.sections.alertsList.alertErrorReasonLicense', { - defaultMessage: 'Cannot run alert', + defaultMessage: 'Cannot run rule', } ); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/alert_quick_edit_buttons.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/alert_quick_edit_buttons.tsx index e40bc4bcf5c83..660c86e97a35e 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/alert_quick_edit_buttons.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/alert_quick_edit_buttons.tsx @@ -62,9 +62,9 @@ export const AlertQuickEditButtons: React.FunctionComponent = ({ } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertsList.bulkActionPopover.failedToMuteAlertsMessage', + 'xpack.triggersActionsUI.sections.alertsList.bulkActionPopover.failedToMuteRulesMessage', { - defaultMessage: 'Failed to mute alert(s)', + defaultMessage: 'Failed to mute rule(s)', } ), }); @@ -82,9 +82,9 @@ export const AlertQuickEditButtons: React.FunctionComponent = ({ } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertsList.bulkActionPopover.failedToUnmuteAlertsMessage', + 'xpack.triggersActionsUI.sections.alertsList.bulkActionPopover.failedToUnmuteRulesMessage', { - defaultMessage: 'Failed to unmute alert(s)', + defaultMessage: 'Failed to unmute rule(s)', } ), }); @@ -102,9 +102,9 @@ export const AlertQuickEditButtons: React.FunctionComponent = ({ } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertsList.bulkActionPopover.failedToEnableAlertsMessage', + 'xpack.triggersActionsUI.sections.alertsList.bulkActionPopover.failedToEnableRulesMessage', { - defaultMessage: 'Failed to enable alert(s)', + defaultMessage: 'Failed to enable rule(s)', } ), }); @@ -122,9 +122,9 @@ export const AlertQuickEditButtons: React.FunctionComponent = ({ } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertsList.bulkActionPopover.failedToDisableAlertsMessage', + 'xpack.triggersActionsUI.sections.alertsList.bulkActionPopover.failedToDisableRulesMessage', { - defaultMessage: 'Failed to disable alert(s)', + defaultMessage: 'Failed to disable rule(s)', } ), }); @@ -142,9 +142,9 @@ export const AlertQuickEditButtons: React.FunctionComponent = ({ } catch (e) { toasts.addDanger({ title: i18n.translate( - 'xpack.triggersActionsUI.sections.alertsList.bulkActionPopover.failedToDeleteAlertsMessage', + 'xpack.triggersActionsUI.sections.alertsList.bulkActionPopover.failedToDeleteRulesMessage', { - defaultMessage: 'Failed to delete alert(s)', + defaultMessage: 'Failed to delete rule(s)', } ), }); diff --git a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/bulk_operation_popover.tsx b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/bulk_operation_popover.tsx index 9b1abcee825bd..56cf856763c94 100644 --- a/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/bulk_operation_popover.tsx +++ b/x-pack/plugins/triggers_actions_ui/public/application/sections/common/components/bulk_operation_popover.tsx @@ -26,7 +26,7 @@ export const BulkOperationPopover: React.FunctionComponent = ({ children }) => { > } diff --git a/x-pack/plugins/triggers_actions_ui/public/plugin.ts b/x-pack/plugins/triggers_actions_ui/public/plugin.ts index 0d6089038c5ad..a027f25d15eb7 100644 --- a/x-pack/plugins/triggers_actions_ui/public/plugin.ts +++ b/x-pack/plugins/triggers_actions_ui/public/plugin.ts @@ -95,12 +95,12 @@ export class Plugin const alertTypeRegistry = this.alertTypeRegistry; const featureTitle = i18n.translate('xpack.triggersActionsUI.managementSection.displayName', { - defaultMessage: 'Alerts and Actions', + defaultMessage: 'Rules and Connectors', }); const featureDescription = i18n.translate( 'xpack.triggersActionsUI.managementSection.displayDescription', { - defaultMessage: 'Detect conditions using alerts, and take actions using connectors.', + defaultMessage: 'Detect conditions using rules, and take actions using connectors.', } ); diff --git a/x-pack/test/functional/services/ml/navigation.ts b/x-pack/test/functional/services/ml/navigation.ts index 57ee7e5ad0954..93b8a5efecc07 100644 --- a/x-pack/test/functional/services/ml/navigation.ts +++ b/x-pack/test/functional/services/ml/navigation.ts @@ -38,7 +38,7 @@ export function MachineLearningNavigationProvider({ async navigateToAlertsAndAction() { await PageObjects.common.navigateToApp('triggersActions'); - await testSubjects.click('alertsTab'); + await testSubjects.click('rulesTab'); await testSubjects.existOrFail('alertsList'); }, diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts index e6eb6f2d65350..d73488fab2373 100644 --- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts +++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts @@ -100,7 +100,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { describe('create alert', function () { before(async () => { await pageObjects.common.navigateToApp('triggersActions'); - await testSubjects.click('alertsTab'); + await testSubjects.click('rulesTab'); }); it('should create an alert', async () => { @@ -144,7 +144,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await testSubjects.click('saveAlertButton'); const toastTitle = await pageObjects.common.closeToast(); - expect(toastTitle).to.eql(`Created alert "${alertName}"`); + expect(toastTitle).to.eql(`Created rule "${alertName}"`); await pageObjects.triggersActionsUI.searchAlerts(alertName); const searchResultsAfterSave = await pageObjects.triggersActionsUI.getAlertsList(); expect(searchResultsAfterSave).to.eql([ @@ -195,7 +195,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await testSubjects.click('saveAlertButton'); const toastTitle = await pageObjects.common.closeToast(); - expect(toastTitle).to.eql(`Created alert "${alertName}"`); + expect(toastTitle).to.eql(`Created rule "${alertName}"`); await pageObjects.triggersActionsUI.searchAlerts(alertName); const searchResultsAfterSave = await pageObjects.triggersActionsUI.getAlertsList(); expect(searchResultsAfterSave).to.eql([ @@ -228,7 +228,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await testSubjects.missingOrFail('confirmAlertSaveModal'); const toastTitle = await pageObjects.common.closeToast(); - expect(toastTitle).to.eql(`Created alert "${alertName}"`); + expect(toastTitle).to.eql(`Created rule "${alertName}"`); await pageObjects.triggersActionsUI.searchAlerts(alertName); const searchResultsAfterSave = await pageObjects.triggersActionsUI.getAlertsList(); expect(searchResultsAfterSave).to.eql([ diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts_list.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts_list.ts index 829fd9c85cbf0..e24d5a4ccf653 100644 --- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts_list.ts +++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alerts_list.ts @@ -51,13 +51,13 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { } async function refreshAlertsList() { - await testSubjects.click('alertsTab'); + await testSubjects.click('rulesTab'); } describe('alerts list', function () { before(async () => { await pageObjects.common.navigateToApp('triggersActions'); - await testSubjects.click('alertsTab'); + await testSubjects.click('rulesTab'); }); afterEach(async () => { @@ -218,7 +218,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await retry.try(async () => { const toastTitle = await pageObjects.common.closeToast(); - expect(toastTitle).to.eql('Deleted 1 alert'); + expect(toastTitle).to.eql('Deleted 1 rule'); }); await pageObjects.triggersActionsUI.searchAlerts(secondAlert.name); @@ -339,7 +339,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await retry.try(async () => { const toastTitle = await pageObjects.common.closeToast(); - expect(toastTitle).to.eql('Deleted 1 alert'); + expect(toastTitle).to.eql('Deleted 1 rule'); }); await pageObjects.triggersActionsUI.searchAlerts(namePrefix); @@ -404,13 +404,11 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await ( await alertsErrorBannerExistErrors[0].findByCssSelector('.euiCallOutHeader') ).getVisibleText() - ).to.equal('Error found in 1 alert.'); + ).to.equal('Error found in 1 rule.'); }); await refreshAlertsList(); - expect(await testSubjects.getVisibleText('totalAlertsCount')).to.be( - 'Showing: 2 of 2 alerts.' - ); + expect(await testSubjects.getVisibleText('totalAlertsCount')).to.be('Showing: 2 of 2 rules.'); expect(await testSubjects.getVisibleText('totalActiveAlertsCount')).to.be('Active: 0'); expect(await testSubjects.getVisibleText('totalOkAlertsCount')).to.be('Ok: 1'); expect(await testSubjects.getVisibleText('totalErrorAlertsCount')).to.be('Error: 1'); diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts index 0017f7ba04b87..d27be915be512 100644 --- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts +++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/details.ts @@ -355,7 +355,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { expect(toastTitle).to.eql('Deleted 1 connector'); // click on first alert - await pageObjects.triggersActionsUI.changeTabs('alertsTab'); + await pageObjects.triggersActionsUI.changeTabs('rulesTab'); await pageObjects.triggersActionsUI.clickOnAlertInAlertsList(alert.name); const editButton = await testSubjects.find('openEditAlertFlyoutButton'); @@ -415,7 +415,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { expect(toastTitle).to.eql('Deleted 1 connector'); // click on first alert - await pageObjects.triggersActionsUI.changeTabs('alertsTab'); + await pageObjects.triggersActionsUI.changeTabs('rulesTab'); await pageObjects.triggersActionsUI.clickOnAlertInAlertsList(alert.name); const editButton = await testSubjects.find('openEditAlertFlyoutButton'); @@ -480,7 +480,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await pageObjects.alertDetailsUI.clickViewInApp(); - expect(await pageObjects.alertDetailsUI.getNoOpAppTitle()).to.be(`View Alert ${alert.id}`); + expect(await pageObjects.alertDetailsUI.getNoOpAppTitle()).to.be(`View Rule ${alert.id}`); }); it('renders a disabled alert details view in app button', async () => { diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/home_page.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/home_page.ts index 6c23a04a0a8d2..1b1288e4b4db8 100644 --- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/home_page.ts +++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/home_page.ts @@ -31,7 +31,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { it('Loads the Alerts page', async () => { await pageObjects.common.navigateToApp('triggersActions'); const headingText = await pageObjects.triggersActionsUI.getSectionHeadingText(); - expect(headingText).to.be('Alerts and Actions'); + expect(headingText).to.be('Rules and Connectors'); }); }); @@ -45,10 +45,10 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { }); it('Loads the Alerts page', async () => { - await log.debug('Checking for section heading to say Triggers and Actions.'); + await log.debug('Checking for section heading to say Rules and Connectors.'); const headingText = await pageObjects.triggersActionsUI.getSectionHeadingText(); - expect(headingText).to.be('Alerts and Actions'); + expect(headingText).to.be('Rules and Connectors'); }); describe('Connectors tab', () => { @@ -70,13 +70,13 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { describe('Alerts tab', () => { it('renders the alerts tab', async () => { // Navigate to the alerts tab - await pageObjects.triggersActionsUI.changeTabs('alertsTab'); + await pageObjects.triggersActionsUI.changeTabs('rulesTab'); await pageObjects.header.waitUntilLoadingHasFinished(); // Verify url const url = await browser.getCurrentUrl(); - expect(url).to.contain(`/alerts`); + expect(url).to.contain(`/rules`); // Verify content await testSubjects.existOrFail('alertsList'); @@ -109,7 +109,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await pageObjects.triggersActionsUI.clickOnAlertInAlertsList(createdAlert.name); // Verify url - expect(await browser.getCurrentUrl()).to.contain(`/alert/${createdAlert.id}`); + expect(await browser.getCurrentUrl()).to.contain(`/rule/${createdAlert.id}`); }); }); }); diff --git a/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/application.tsx b/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/application.tsx index b15f2031e3a2b..2198ce456be4f 100644 --- a/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/application.tsx +++ b/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/application.tsx @@ -21,11 +21,11 @@ const AlertingExampleApp = (deps: AlertingExampleComponentParams) => { ) => { return ( -

View Alert {props.match.params.id}

+

View Rule {props.match.params.id}

 ); }} diff --git a/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/plugin.ts b/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/plugin.ts index e314ced54d0a2..48a3aca742c72 100644 --- a/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/plugin.ts +++ b/x-pack/test/functional_with_es_ssl/fixtures/plugins/alerts/public/plugin.ts @@ -24,7 +24,7 @@ export class AlertingFixturePlugin implements Plugin `/alert/${alert.id}` + (alert: SanitizedAlert, alertType: AlertType) => `/rule/${alert.id}` ); triggersActionsUi.alertTypeRegistry.register({ diff --git a/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts b/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts index 7b5e0c81479f9..8d4311a3ec322 100644 --- a/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts +++ b/x-pack/test/functional_with_es_ssl/page_objects/triggers_actions_ui_page.ts @@ -138,7 +138,7 @@ export function TriggersActionsPageProvider({ getService }: FtrProviderContext) await this.searchAlerts(name); await find.clickDisplayedByCssSelector(`[data-test-subj="alertsList"] [title="${name}"]`); }, - async changeTabs(tab: 'alertsTab' | 'connectorsTab') { + async changeTabs(tab: 'rulesTab' | 'connectorsTab') { await testSubjects.click(tab); }, async toggleSwitch(testSubject: string) {