Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security GenAI] [ Integration Assistant ] Add unit tests for Integration Assistant plugin files #186512

Merged
merged 96 commits into from
Jun 25, 2024

Conversation

bhapas
Copy link
Contributor

@bhapas bhapas commented Jun 20, 2024

Summary

This PR adds unit tests to the logic introduced in Integration Assistant plugin - #184296

Checklist

Delete any items that are not applicable to this PR.

bhapas and others added 30 commits June 20, 2024 11:31
…migrations (elastic#186090)

## Summary

Addresses elastic#177831.

The PR introduces specific steps to check that
`cluster.routing.allocation.enable` has a suitable value for _reindex
migrations_.
Up until now, this check was done systematically after the `INIT` step.

Now, a couple new dedicated steps have been introduced, which allow
verifying this setting on _reindex migrations_ only (highlighted in
orange):


![image](https://github.com/elastic/kibana/assets/25349407/07c7f0b4-fa11-4925-908a-3cb222685796)
## Summary

Partially addresses elastic#184498

The main contribution of this PR is the `METRICS` command validation
cases:

<img width="778" alt="image"
src="https://github.com/elastic/kibana/assets/82822460/3d768952-3fa3-4928-b251-204c30d20c4b">

See own-review below for more comments.


### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <[email protected]>
## Summary
With the migration to the shared buildkite infra, we've also switched to
using the ci-prod vault (https://vault-ci-prod.elastic.dev) for all
CI-related secrets. We found it reasonable then, to also switch the
storage of the credentials for the deployments there. It's since been
proven unnecessary, even confusing for developers, as they might not be
adequately set up for accessing the two vaults. We've also learned, that
both of these vault instances are here to stay, so there's no push to
migrate everything to the ci-prod instance.

So, this PR switches back to using the legacy vault in all cases for
storing deployment keys, as it fits better with the developers' daily
secret handling duties.

Also, adds a cleanup part to the purge routine.

- [x] extract vault read / write to a parametric shell script, because
the typescript invocations to vault won't have an easy access to the
`set_in_legacy_vault`
…lastic#185030)

## Summary
- update api tests in
`x-pack/test_serverless/api_integration/test_suites/common/search_oss/`



Contributes to: elastic#180834

---------

Co-authored-by: Kibana Machine <[email protected]>
…re pages (elastic#186456)

This PR, a follow-up to elastic#186375, adds a new column for Asset Criticality
to the "All hosts" tab in the Explore/Hosts page.
If any of the hosts has criticality data assigned, it will be displayed
in the new column. If no criticality has been assigned, the field is
left blank.

<img width="1530" alt="Screenshot 2024-06-19 at 13 46 52"
src="https://github.com/elastic/kibana/assets/2423976/054d0bb0-8858-40ae-ab20-7fe6f31e5858">

### How to test

1. Make sure you have test data with Asset Criticality.
- Either use the [datagen
tool](https://github.com/elastic/security-documents-generator) or just
make sure to assign criticality to already existing hosts
2. Enable Asset Criticality settings in `Stack Management > Kibana >
Advanced Settings`
3. Navigate to `Explore > Users > All Users`

Co-authored-by: Kibana Machine <[email protected]>
Closes elastic/sdh-kibana#4739

## Summary

Fixes an issue with process chart query where it was fetching only for 1
minute while the chart was expecting data for 15 minites.

The issue was that `query` was filtering the documents by the latest 1
minute while `date_histogram` is using `extended_bounds` to cover the
last 15 minutes (relative the to provided `to` date). `extended_bounds`
ensures that we return buckets for 15 minutes range even if some buckets
are empty, but it does not expand the filter range from the `query`
which is set to 1 minute, meaning the first 13 buckets were always
empty.

This change expands the `filter` query for the chart to 15 minutes.

**After the change**
![CleanShot 2024-06-19 at 19 57
33@2x](https://github.com/elastic/kibana/assets/793851/5b828891-1f73-4b27-b73f-c48501bcf69b)
…tails page and Creation Rule flyout (elastic#184950)

## Summary
Fixes elastic#184922
Fixes elastic#184574

It uses the `RuleConditionChart`, a.k.a Lens chart, for the Metric
Threshold rule.
### Implemented in both places:
- Metric Alert Details page
![Screenshot 2024-06-10 at 16 12
43](https://github.com/elastic/kibana/assets/6838659/9d88d9b9-fe5d-4f8d-9e5a-538c52c58692)

- Rule creation flyout
![Screenshot 2024-06-10 at 16 13
18](https://github.com/elastic/kibana/assets/6838659/8c9ca3b3-2fbf-4cfa-83c9-00278c5e8e77)
Towards: elastic#169867

This PR onboards the Synthetics Monitor Status rule type with FAAD.

### To verify
I can't get the rule to alert, so I modified the status check to report
the monitor as down. If you know of an easier way pls let me know 🙂

1. Create a [monitor](http://localhost:5601/app/synthetics/monitors), by
default creating a monitor creates a rule.
2. Click on the monitor and grab the id and locationId from the url
3. Go to [the status check
code](https://github.com/elastic/kibana/blob/main/x-pack/plugins/observability_solution/synthetics/server/queries/query_monitor_status.ts#L208)
and replace the object that is returned with the following using the id
and locationId you got from the monitor.
```
{
    up: 0,
    down: 1,
    pending: 0,
    upConfigs: {},
    pendingConfigs: {},
    downConfigs: {
      '${id}-${locationId}': {
        configId: '${id}',
        monitorQueryId: '${id}',
        status: 'down',
        locationId: '${locationId}',
        ping: {
          '@timestamp': new Date().toISOString(),
          state: {
            id: 'test-state',
          },
          monitor: {
            name: 'test-monitor',
          },
          observer: {
            name: 'test-monitor',
          },
        } as any,
        timestamp: new Date().toISOString(),
      },
    },
    enabledMonitorQueryIds: ['${id}'],
  };
```
5. Your rule should create an alert and should saved it in
`.internal.alerts-observability.uptime.alerts-default-000001`
Example:
```
GET .internal.alerts-*/_search
```
6. Recover repeating step 3 using
```
{
    up: 1,
    down: 0,
    pending: 0,
    downConfigs: {},
    pendingConfigs: {},
    upConfigs: {
      '${id}-${locationId}': {
        configId: '${id}',
        monitorQueryId: '${id}',
        status: 'down',
        locationId: '${locationId}',
        ping: {
          '@timestamp': new Date().toISOString(),
          state: {
            id: 'test-state',
          },
          monitor: {
            name: 'test-monitor',
          },
          observer: {
            name: 'test-monitor',
          },
        } as any,
        timestamp: new Date().toISOString(),
      },
    },
    enabledMonitorQueryIds: ['${id}'],
  };
```
8. The alert should be recovered and the AAD in the above index should
be updated `kibana.alert.status: recovered`.
Makes the clone operation use runtime state rather than serialized state.
elastic#184309)

# Pull Request Overview
This pull request (PR):
1. Enables Product Types for FTR API Integration Test Suites in
Serverless MKI:
- Previously, the test suites ignored product types entirely. With this
PR, scripts to run the tests have been relocated to
x-pack/test/security_solution_api_integration/scripts.
- Users can now run tests from the API Integration tests directory for
security solutions by using the command:
TARGET_SCRIPT={script_from_package_json} node
./scripts/mki_start_api_ftr_execution. This will execute the following
steps:
1. Create a security serverless project, respecting the product types
specified in the serverless configuration found in the config folder of
the relevant test suite.
      2. Reset credentials.
3. Wait for Elasticsearch (ES) and Kibana to be ready and available.
      4. Execute the tests.
      5. Delete the project upon completion.
2. Adds Proxy Services Organizations to .ftr Role Users Files:
- This PR updates the .ftr role_users files to include all proxy
services organizations, ensuring they have the necessary permissions for
the tests.

# Implementation Details
Product Types

  - Previous Setup:
- A project was created and handed over to the test suite to run the API
tests against, without considering product types.
  - Changes Introduced:
- The script execution for tests has moved to
x-pack/test/security_solution_api_integration/scripts.
- Tests can be initiated using the command from the API Integration
tests folder where package.json exists:
      ```
TARGET_SCRIPT={script_from_package_json} node
./scripts/mki_start_api_ftr_execution
      ```
- The mki_start_api_ftr_execution script performs several steps to run
the tests, including creating a security serverless project with
specified product types, resetting credentials, ensuring ES and Kibana
readiness, executing tests, and cleaning up the project afterward.
- The script reads extra configuration (currently only product types are
supported) in the specific format as is, from the following file :
[api_configs.json](https://github.com/elastic/kibana/pull/184309/files#diff-1122baffe7ff843b1f486cee95468bed5851a9a4934be747f540bd42dc9a07daR2).
The key for the JSON file is the name of the script in
[package.json](https://github.com/elastic/kibana/pull/184309/files#diff-c6af1c81947b3a77bed431c688c7ad38c8969bd52e1c3ea92d643f09d422eb61R296)
- If a specific configuration is not required and the default complete
project is needed for the test to run, the key and configuration in the
`api_configs.json` file can be ommitted.

# Summary

This PR enhances the flexibility and functionality of the FTR API
integration test suites for serverless MKI by incorporating product type
considerations and updating the role_users configuration to include
proxy services organizations.

---------

Co-authored-by: kibanamachine <[email protected]>
…c#184640)

## Summary

As part of the PR, i have rewritten 4 of the test files for both
serverless and stateful for Dataset Quality Project

- `/dataset_quality/dataset_quality_summary.ts`
  - Closes - elastic#178874
  - Closes - elastic#178884
  - Closes - elastic#186354
- `/dataset_quality/dataset_quality_table.ts`
- Closes - elastic#183940 (Possibly,
not guaranteed)
  - Closes - elastic#182353
- `/dataset_quality/dataset_quality_table_filters.ts`
  - Closes - elastic#183861
  - Closes - elastic#182320
  - Closes - elastic#184852
- `/dataset_quality/dataset_quality_flyout.ts`
  - Closes - elastic#184438
  - Closes - elastic#183851
  - Closes - elastic#183771
  - Closes - elastic#183525
  - Closes - elastic#183312
  - Closes - elastic#183129
  - Closes - elastic#182154
  
## Why are the tests re-written

- Most of the `it` were loading its own data, which add 2 problems, 1.
Makes our tests slower, 2. Data cleanup becomes challenging. Now the
tests simply load one master set of data and all the Functional tests
can be executed on that master data. This makes our tests leaner and
more functional.

- Every `it` resets the page state after the tests. Like when a `it`
blocks opens the Flyout, it should also close the flyout which was
missing. In order to refresh the page, the `navigate` API was used,
which is not good. Navigate API should only be used once to navigate to
the page in the starting and then refresh events should be used if a
refresh is required, or the action should be un-done in order to get the
same state as previous. For ex - Sorting make update the state of the
whole page. At the end of the sorting test, sorting should be reset.
With these changes `it` block now only focus on pure functional testing.
This means the `it` blocks can be moved around, skipped without
impacting other tests

- We had too much of generic tests, which could be combined into 1 `it`
block and be checked together. Idea to split 1 `it` block into another
is when we test for a completely different scenario. For eg - Writing a
single `it` for testing different columns of a table is much more
cleaner than multiple `it` for testing various columns of the same
table.

- Removed usage of `retry.try`. (Personal Opinion, please read it with a
pinch of salt) - The retry service seems like an escape hatch (read
workaround) when we don't have control over the rendering of UI
elements. Better alternative is to use `retry.tryforTime` as the last
resort.
Also the only time i found using the whole `retry` package was when we
use the `browser` package for getting URL value of refreshing page. I
cannot prove yet the problem with the `browser` package but somehow it
breaks the sync behaviour causing elements to be not available hence
requiring these retries.
I have removed `browser.refresh` completely from our code in favour of
better refresh handlers using DateTimePicker Refresh action


Linked Issued - elastic#184145
## Summary

The `PUT` endpoint was deprecated and removed on [February
20](https://groups.google.com/a/elastic.co/g/dev/c/1S0xcVAbmCA/m/Ybkr1H01AQAJ).
We should use `PATCH` when updating the existing projects.
…ble (elastic#186425)

## Summary
<img width="1478" alt="Screenshot 2024-06-18 at 6 10 05 PM"
src="https://github.com/elastic/kibana/assets/8703149/f095591d-f0ee-41bd-8b7d-07880bcf61d9">


Currently we have an issue where if user already has localStorageKey
from previous version where we still use Update for our Column Label and
then proceed to upgrading to version where we no longer use that, the
column name in Findings table will show field name (it shows resource.id
instead of Resource ID)

also because we changed the logic and not allow users to change the
column headers in the data grid, option to **edit data view field** is
removed for Cloud Security Table
<img width="741" alt="Screenshot 2024-06-19 at 9 16 06 AM"
src="https://github.com/elastic/kibana/assets/8703149/df1ec765-89de-4f43-a723-daf9558af135">


This patch fixes that issues

Related to elastic#184295
…stic#186379)

Closes elastic#186336 by adding helper functions for creating 201, 207 and 422
responses.
…lastic#186488)

## Summary

We no longer uses with Operator role when doing serverless FTR,
…6084)

## Summary

Closes elastic#184394

Added agent policy selection to Edit integration policy page.


There is a lot of duplication between Create and Edit integration policy
pages, I'll see if I can refactor to extract the common logic: steps
components and managing its state.
I extracted the steps to a hook, it would be a bigger refactor to use
this in Create package policy page, so I might create a follow up issue
for that.

## To verify
- enable the `enableReusableIntegrationPolicies` experimental feature in
`kibana.dev.yml`
- Create a few agent policies
- Add an integration 
- Go to Edit integration, and modify the linked agent policies
- Verify that the existing agent policies are populated correctly in the
Existing hosts combo box
- Verify that the modified agent policy list is reflected in the
`Preview API Request`, `policy_ids` list.
- Verify that when submitting the form, the package policy linkages are
updated to the selected ones (add/remove agent policies)
- The agent count should update below the combo / in the submit modal
window
- It's not allowed to submit the form after removing all agent policies
- If a new agent policy is selected, it will be created first and then
assigned to the integration policy

<img width="995" alt="image"
src="https://github.com/elastic/kibana/assets/90178898/0a7163c6-154e-49b1-b73c-19ed024f6dc3">
<img width="993" alt="image"
src="https://github.com/elastic/kibana/assets/90178898/ad470a27-90fa-40f5-b394-a93a08c95e06">
<img width="535" alt="image"
src="https://github.com/elastic/kibana/assets/90178898/3b0ddc29-abf8-4e0d-8beb-300634c245b3">
<img width="1758" alt="image"
src="https://github.com/elastic/kibana/assets/90178898/e8b976fe-3e53-439c-9b23-803deaf3e0aa">

### Create agent policy
<img width="1737" alt="image"
src="https://github.com/elastic/kibana/assets/90178898/6f2a7f65-981a-487d-87c4-2dbb7ecd1835">
Preview API request contains the POST agent policy request
<img width="896" alt="image"
src="https://github.com/elastic/kibana/assets/90178898/109140ab-13f2-42c9-9bbc-fb64859c4f62">
After submit, the updated integration policy is assigned to the new
agent policy too
<img width="2552" alt="image"
src="https://github.com/elastic/kibana/assets/90178898/4027b47b-8d20-4153-b7ec-ed3500f08c9a">


## Open questions

- Currently the namespace placeholder of the package policy is set to
show the namespace of the first selected agent policy (if not set by the
package policy). I have to check what happens on the backend, if the
inherited namespace is changed if the agent policies change. The
behaviour should be consistent in the backend and UI.
Currently on the Agent policy details UI, the same integration policy
might show different inherited namespace if its shared by multiple agent
policies with different namespace.

<img width="1498" alt="image"
src="https://github.com/elastic/kibana/assets/90178898/567800a8-2dcb-4b18-af89-f6e902889092">
<img width="1326" alt="image"
src="https://github.com/elastic/kibana/assets/90178898/b59d131e-314c-4d5a-81e3-ab8fe0fa6e1f">
<img width="1318" alt="image"
src="https://github.com/elastic/kibana/assets/90178898/69b54a63-f7c1-4f0f-8041-74b1774f1e9e">

- When the Edit integration was started from the Agent policy details
UI, the navigation goes back to the same agent policy after submitting
the page. Is this okay? Might be somewhat unexpected if creating a new
agent policy, though it is getting complex to decide where to navigate
in case of multiple agent policies.


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Kibana Machine <[email protected]>
Co-authored-by: criamico <[email protected]>
## Summary

Closes elastic#184695.

This stores the user's last scroll position on the dashboard container
when they maximize a panel. On minimize, we scroll back to their
original position on the dashboard.

![Jun-03-2024
17-52-35](https://github.com/elastic/kibana/assets/1697105/af37a8fc-d9d5-42cb-b7e8-58e064035012)

### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.

When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:

| Risk | Probability | Severity | Mitigation/Notes |

|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces&mdash;unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes&mdash;Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
…uced in 8.15. (elastic#186426)

Adds dev console changes for the following: 

- `rule_query` was renamed to `rule`
- `semantic` query was added
- `sparse_vector` query was added
… error cases (elastic#186407)

PR updates initializeDataControl to handle error cases like DataView not
found and field not found.

---------

Co-authored-by: kibanamachine <[email protected]>
…preview into panels (elastic#186218)

## Summary

We want to have a preview for alert/events. Currently alert reason and
rule overview are embedded in the same preview. This PR separate them
into their own panels, so that they can be called outside of document
details if needed in the future. The `DocumentDetailPreviewPanelKey`
reference is removed, but will be used again when setting the preview
for alerts/events.

No functionality changed in this PR.

This PR is part 1 of refactoring document details code for alert
preview:

1️⃣ ➡️ separating the alert reason and rule overview into their own
panels
2️⃣ refactor left and right context to share
`DocumentDetailsPanelContext`, which will reduce the duplication for
alert preview
3️⃣ set up preview context for the actual alert/event details preview

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
…lastic#184548)

## Summary

This PR adds endpoints for managing builtin entity discovery:
- `GET /internal/api/entities/managed/enablement`: check if stored API
key exists and is valid, then checks whether builtin definitions are
installed and running
- `PUT /internal/api/entities/managed/enablement`: creates API key if
none exists, then installs and kickoff the builtin definitions
- `DELETE /internal/api/entities/managed/enablement`: stops and
uninstalls builtin definitions, then delete API key
- `GET /internal/api/entities/definition`: returns the definitions
installed and their corresponding state `{ installed: bool, running:
bool }`

The API key is stored in an encrypted saved object, and has only the
permissions required to manage the transforms/ingest pipelines, and read
the source data.
Built in definitions are stored in code and have hardcoded IDs with a
special prefix `builtin_`.

The change also includes an `entityClient` that can be consumed by
public plugins and exposes methods that proxy the http endpoints listed
previously.

### Testing
- verify entity discovery is not enabled with `GET
kbn:/internal/api/entities/managed/enablement`
- setup entity discovery with `PUT
kbn:/internal/api/entities/managed/enablement`
- verify builtin definitions are installed and running `GET
kbn:/internal/api/entities/definition?builtIn=true`
- verify entity discovery is enabled with `GET
kbn:/internal/api/entities/managed/enablement`
- disable entity discovery with `DELETE
kbn:/internal/api/entities/managed/enablement`
- verify builtin definitions are not installed anymore `GET
kbn:/internal/api/entities/definition?builtIn=true`
- verify entity discovery is disabled with `GET
kbn:/internal/api/entities/managed/enablement`

---------

Co-authored-by: Kevin Lacabane <[email protected]>
Co-authored-by: kibanamachine <[email protected]>
## Summary

Close elastic#186413

<img width="303" alt="Screenshot 2024-06-18 at 1 35 52 PM"
src="https://github.com/elastic/kibana/assets/315764/92d10866-dc46-4c0f-b6d9-e4aa09e0c9c9">

Co-authored-by: Kibana Machine <[email protected]>
Co-authored-by: Stratoula Kalafateli <[email protected]>
## Summary

fixes elastic#183012 
- Rename `assets` to `entities`
- Update entities index: `.entities-observability.latest-*` The index
where the data transform writes the summaries
- Show a search field to filter by service name. This will allow the
user to filter the table without knowing the entities index and the
fields.
- Use the same template and path for the service inventory`/services` . 
- `throughput` remains the initial sorting field
- Merge the entities with the the same service name and calculates the
averages in the front end







https://github.com/elastic/kibana/assets/3369346/2dbc07e9-3086-4d32-a98e-5dc364f59554



### How to test
1. Add the config to your kibana.yml
```
xpack.assetManager:
  alphaEnabled: true
```
2. Enable `observability:apmEnableMultiSignal` in advansted settings
 
<details>


<summary>3. Run the entities definition in the dev tools</summary>


```
POST kbn:/internal/api/entities/definition
{
  "id": "apm-services-with-metadata",
  "name": "Services from logs and metrics",
  "displayNameTemplate": "test",
  "history": {
    "timestampField": "@timestamp",
    "interval": "5m"
  },
  "type": "service",
  "indexPatterns": [
    "logs-*",
    "metrics-*"
  ],
  "timestampField": "@timestamp",
  "lookback": "5m",
  "identityFields": [
    {
      "field": "service.name",
      "optional": false
    },
    {
      "field": "service.environment",
      "optional": true
    }
  ],
  "identityTemplate": "{{service.name}}:{{service.environment}}",
  "metadata": [
    "tags",
    "host.name",
    "data_stream.type",
    "service.name", 
    "service.instance.id",
    "service.namespace",
    "service.environment",
    "service.version",
    "service.runtime.name",
    "service.runtime.version",
    "service.node.name",
    "service.language.name",
    "agent.name",
    "cloud.provider",
    "cloud.instance.id",
    "cloud.availability_zone",
    "cloud.instance.name",
    "cloud.machine.type",
    "container.id"
  ],
  "metrics": [
    {
      "name": "latency",
      "equation": "A",
      "metrics": [
        {
          "name": "A",
          "aggregation": "avg",
          "field": "transaction.duration.histogram"
           
          
        }
      ]
    },
    {
      "name": "throughput",
      "equation": "A / 5",
      "metrics": [
        {
          "name": "A",
          "aggregation": "doc_count",
          "filter": "transaction.duration.histogram:*"
        }
      ]
    },
    {
      "name": "failedTransactionRate",
      "equation": "A / B",
      "metrics": [
        {
          "name": "A",
          "aggregation": "doc_count",
          "filter": "event.outcome: \"failure\""
        },
        {
          "name": "B",
          "aggregation": "doc_count",
          "filter": "event.outcome: *"
        }
      ]
    },
    {
      "name": "logErrorRate",
      "equation": "A / B",
      "metrics": [
        {
          "name": "A",
          "aggregation": "doc_count",
          "filter": "log.level: \"error\""
        },
        {
          "name": "B",
          "aggregation": "doc_count",
          "filter": "log.level: *"
        }
      ]
    },
     {
      "name": "logRatePerMinute",
      "equation": "A / 5",
      "metrics": [
        {
          "name": "A",
          "aggregation": "doc_count",
          "filter": "log.level: \"error\""
        }
      ]
    }
  ]
}
```

</details>

4. Generate data with synthrace

    1. logs only: `node scripts/synthtrace simple_logs.ts`
    2. APM only: `node scripts/synthtrace simple_trace.ts` 


### Checklist
- [ ] There is a issue with the `SearchBar` that causing the gap between
the search field and the timerange. I need to check it
…ard accessible (elastic#183509)

Closes: elastic/observability-dev#3358

## Description

The Obs Alert Rules view has a `State` dropdown menu that cannot be
accessed by keyboard. I've included a MOV file that shows the keypress
events I tried to interact with the menu.

### Steps to recreate

1. Open the [Obs Alerts
Rules](https://keepserverless-qa-oblt-b4ba07.kb.eu-west-1.aws.qa.elastic.cloud/app/observability/alerts/rules)
table
2. Tab to the `State` button
3. Press `Enter` to open the menu
4. Click `Tab` and `Down_Arrow` to verify no action is being taken
5. Hover over the menu options and click one with a mouse to verify
action is being taken

### What was changed?: 
1. EuiSelectableListItem was replace to EuiSelectable

### Screen:


https://github.com/elastic/kibana/assets/20072247/befc9c75-9313-416a-be64-cc0b67f97a84
@bhapas
Copy link
Contributor Author

bhapas commented Jun 24, 2024

@elasticmachine merge upstream

@bhapas
Copy link
Contributor Author

bhapas commented Jun 24, 2024

/ci

@bhapas
Copy link
Contributor Author

bhapas commented Jun 25, 2024

@elasticmachine merge upstream

@bhapas
Copy link
Contributor Author

bhapas commented Jun 25, 2024

/ci

@bhapas bhapas self-assigned this Jun 25, 2024
@bhapas bhapas added test test-coverage issues & PRs for improving code test coverage 8.15 candidate Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. and removed test labels Jun 25, 2024
@bhapas bhapas marked this pull request as ready for review June 25, 2024 10:39
@bhapas bhapas requested a review from a team as a code owner June 25, 2024 10:39
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@bhapas bhapas added the release_note:skip Skip the PR/issue when compiling release notes label Jun 25, 2024
@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @bhapas

@bhapas bhapas merged commit 4ffd530 into elastic:main Jun 25, 2024
16 checks passed
@kibanamachine kibanamachine added v8.15.0 backport:skip This commit does not require backporting labels Jun 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
8.15 candidate backport:skip This commit does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. test-coverage issues & PRs for improving code test coverage v8.15.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.