Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Observability][RAC] Users need view_index_metadata index privilege to view fields on Alerts page #133060

Closed
Tracked by #132816 ...
simianhacker opened this issue May 26, 2022 · 4 comments
Assignees
Labels
bug Fixes for quality problems that affect the customer experience Feature:Observability RAC Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@simianhacker
Copy link
Member

simianhacker commented May 26, 2022

Kibana version:

8.x (all versions)

Elasticsearch version:

8.x (all versions)

Original install method (e.g. download page, yum, from source, etc.):

ALL

Describe the bug:

When using a restricted role, the user is unable to see the fields in the fields selector on the Alerts page

image

Steps to reproduce:

  1. Create a new role named test_role to match
    image
  2. Create user with the test_role
  3. Log in with your new user
  4. Create an alert that is triggering
  5. Visit the Alerts page for Observability
  6. Click on the "Fields" selector icon under the search bar. The selector will will be empty.

Expected behavior:

You shouldn't need special permissions on the .alert* index pattern to select fields. The work around is to add view_index_metadata to the .alerts* pattern for the role.

Any additional context:

Here is the call that is populating the fields.

fields: await dataViews.getFieldsForWildcard({
pattern: indexNames.join(','),
allowNoIndex: true,
}),

This needs to be changed to use a query that is called by asInternalUser which is only available on the server. We should probably create a search strategy to generate dynamic index patterns similar to the index_fields search strategy from the timelines plugin.

@simianhacker simianhacker added bug Fixes for quality problems that affect the customer experience Feature:Observability RAC Team: Actionable Observability - DEPRECATED For Observability Alerting and SLOs use "Team:obs-ux-management", for AIops "Team:obs-knowledge" labels May 26, 2022
@kobelb
Copy link
Contributor

kobelb commented May 26, 2022

Unfortunately, DataViews weren't created to work with internal indices like the .alerts-* indices, where end-users don't have privileges to read data directly from the ES indices. We'll need to figure out a different way to get the list of alert fields. @XavierM - have you all solved this problem already when creating the shared alerts table?

@simianhacker
Copy link
Member Author

simianhacker commented Jun 7, 2022

This should be solved once we upgrade to the RAC shared alerts table (#132816).

@XavierM XavierM self-assigned this Jun 9, 2022
@emma-raffenne emma-raffenne added the Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) label Jun 21, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

@jcger
Copy link
Contributor

jcger commented Sep 21, 2022

Fixed after closing #137988

@jcger jcger closed this as completed Sep 21, 2022
Repository owner moved this from In Review to Done in AppEx: ResponseOps - Rules & Alerts Management Sep 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Feature:Observability RAC Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
No open projects
Development

No branches or pull requests

6 participants