[RAC][Observability] Unable to load alerts in Observability alerts table if custom feature privileges are set

[mgiota]

📝 Summary

If a user has no Kibana privileges to view an Observability app, when he goes to the Observability > Alerts table to see the alerts of the rest Observability apps he has access to, he gets an error and sees no alerts at all.

Steps to reproduce

1. Make sure to create some rule types for different Observability apps, Logs and Metrics in the example below.

2. Create a custom role and set None to one of the Observability Apps, Metrics in the example below. Create a new user and assign him the new role.

3. Login with the new user and go to Observability alerts. Observability table is empty and an error is shown Failed to run search on timeline events

✔️ Acceptance criteria

No privilege for Metrics app, privilege to access Logs app

• Given user has no privilege to see the Metrics app
• And he has the privilege to see the Logs app
• When he has enabled a Log threshold rule type
• And goes to the Observability Alerts table
• Then he should be able to see the log threshold alerts
• And no metric alerts

[elasticmachine]

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

[weltenwort]

@yctercero @dhurley14 could you help us figure out what might be the problem here?

[dhurley14]

@mgiota @weltenwort Definitely. Can you export and post the JSON representation of the role for the user? It will be easier to determine exactly which privileges are missing if we see the full role.

[mgiota]

@dhurley14 Sure here's the json response I got from that request URL http://localhost:5631/ncl/api/security/role/test_role

{
   "name":"test_role",
   "metadata":{
      
   },
   "transient_metadata":{
      "enabled":true
   },
   "elasticsearch":{
      "cluster":[
         "all"
      ],
      "indices":[
         
      ],
      "run_as":[
         "test",
         "kibana_system_user"
      ]
   },
   "kibana":[
      {
         "base":[
            
         ],
         "feature":{
            "discover":[
               "read"
            ],
            "dashboard":[
               "read"
            ],
            "canvas":[
               "read"
            ],
            "maps":[
               "read"
            ],
            "ml":[
               "read"
            ],
            "graph":[
               "read"
            ],
            "visualize":[
               "read"
            ],
            "apm":[
               "all"
            ],
            "uptime":[
               "all"
            ],
            "siem":[
               "read"
            ],
            "observabilityCases":[
               "read"
            ],
            "dev_tools":[
               "read"
            ],
            "advancedSettings":[
               "read"
            ],
            "indexPatterns":[
               "read"
            ],
            "savedObjectsManagement":[
               "read"
            ],
            "savedObjectsTagging":[
               "read"
            ],
            "fleet":[
               "read"
            ],
            "actions":[
               "read"
            ],
            "stackAlerts":[
               "read"
            ],
            "logs":[
               "all"
            ]
         },
         "spaces":[
            "default"
         ]
      }
   ],
   "_transform_error":[
      
   ],
   "_unrecognized_applications":[
      
   ]
}

Let me know if that's all you need or if you need anything else I am not aware of.

[weltenwort]

Is it possible that the RBAC part for the Alerts table is simple missing until #107242? Or is this unrelated?

[yctercero]

Yes, #107242 needs to go in. We were doing the back and front end separate and had hoped to have this in last week. @weltenwort I saw you still have some blockers up but I think you got a chance to chat with @XavierM about it. Are they still blockers?

[mgiota]

I tested again after merge of #107242:

• I don't get the Failed to run search on timeline events error I was getting before, which looks good
• but I don't see any alerts in the Observability > Alerts table anymore.
• I don't see any alerts with a kibana_system_user as well.

Could it be that above PR is responsible for Alerts not being shown anymore?

[weltenwort]

@mgiota Did you create the alerts via the respective solution UI or the central rule management? The alerts from the latter don't show up yet as has been discussed last week. I'll follow up on how we'll fix that soon.

[mgiota]

@weltenwort These alerts were created via the respective solution UI. The issue was a custom xpack.ruleRegistry.index I was using. I removed that and I confirm that alerts appear in my table as expected.