Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Alerting] Add bulk AlertsClient functions #99216

Closed
marshallmain opened this issue May 4, 2021 · 6 comments
Closed

[Alerting] Add bulk AlertsClient functions #99216

marshallmain opened this issue May 4, 2021 · 6 comments
Labels
Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@marshallmain
Copy link
Contributor

marshallmain commented May 4, 2021

Describe the feature:
Bulk alert management functions on the AlertsClient, including bulkGet, bulkCreate, etc. The bulk functions should share authorization logic across alerts to reduce the CPU load compared to repeated calls to the non-bulk analogous function.

Proposed bulkGet implementation: https://github.com/marshallmain/kibana/blob/rules-status-aggs/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts#L386-L433

Specific use case:
On the detection engine rules management page we display the status of each rule and refresh the statuses periodically. Our rule status API currently calls AlertsClient.get for each rule on the page to retrieve the alerting framework status for the rule. Even though we use async to make the calls to AlertsClient.get, there is significant CPU cost in the authorization logic of get and the CPU usage ends up becoming the dominant factor when fetching hundreds of alert statuses. A bulk function that can fetch multiple alerts while sharing the same authorization would allow our status route to be much faster.

Other bulk routes would be useful as well. bulkCreate in particular would have immediate applications for the detection engine, as we have a bulk create route that makes repeated calls to the AlertsClient.create function.

@marshallmain marshallmain added Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) labels May 4, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

@marshallmain
Copy link
Contributor Author

cc @legrego @thomheymann @gmmorris

@gmmorris
Copy link
Contributor

gmmorris commented May 5, 2021

Thanks @marshallmain , we'll discuss it in our triage meeting today

@pmuellr
Copy link
Member

pmuellr commented May 5, 2021

We have an issue open for some other bulk operations - #53144

@gmmorris
Copy link
Contributor

gmmorris commented May 6, 2021

Thanks @pmuellr ,
@mikecote can decide whether to dedup this when he's back next week 👍

@mikecote
Copy link
Contributor

@marshallmain I've merged this issue with #53144 and used your description there. Since they're both tracking the same request, I will go ahead and close this one. I do understand this the top ask from the detections team (#67992) and it will be up for consideration soon.

@kobelb kobelb added the needs-team Issues missing a team label label Jan 31, 2022
@botelastic botelastic bot removed the needs-team Issues missing a team label label Jan 31, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
None yet
Development

No branches or pull requests

6 participants