Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Execution type field #195884

Merged
merged 17 commits into from
Oct 14, 2024
Merged

Execution type field #195884

merged 17 commits into from
Oct 14, 2024

Conversation

nkhristinin
Copy link
Contributor

@nkhristinin nkhristinin commented Oct 11, 2024

Added new field - execution type for alerts

Added new field only for security type alerts:

kibana.alert.rule.execution.type - can be manual or scheduled

Also, move intended timestamp settings from create_persistence_rule_type_wrapper to build_alert

Also added those new field to Alert schema and types.

Screen.Recording.2024-10-11.at.16.12.08.mov

For tests:

  • tests all rule types with and without suppression: kibana.alert.rule.execution.type - should be scheduled, kibana.alert.intended_timestamp - should equal alert timestamp

  • tests all rules with and without suppression with manual run - kibana.alert.rule.execution.type - should be manual,
    kibana.alert.intended_timestamp - should equal date inside you manual rule run date range

@nkhristinin
Copy link
Contributor Author

/ci

@nkhristinin nkhristinin marked this pull request as ready for review October 11, 2024 14:03
@nkhristinin nkhristinin requested review from a team as code owners October 11, 2024 14:03
@nkhristinin nkhristinin requested a review from vitaliidm October 11, 2024 14:03
@nkhristinin nkhristinin added release_note:skip Skip the PR/issue when compiling release notes backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) labels Oct 11, 2024
Copy link
Contributor

@dominiqueclarke dominiqueclarke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Contributor

@ymao1 ymao1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

response ops changes lgtm

@@ -50,6 +51,7 @@ export const wrapSuppressedNewTermsAlerts = ({
publicBaseUrl: string | undefined;
primaryTimestamp: string;
secondaryTimestamp?: string;
intendedTimestamp?: Date;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
intendedTimestamp?: Date;
intendedTimestamp: Date | undefined;

@@ -52,6 +53,7 @@ export const wrapSuppressedEsqlAlerts = ({
};
primaryTimestamp: string;
secondaryTimestamp?: string;
intendedTimestamp?: Date;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
intendedTimestamp?: Date;
intendedTimestamp: Date | undefined;

@@ -47,7 +47,8 @@ export const buildAlertGroupFromSequence = (
buildReasonMessage: BuildReasonMessage,
indicesToQuery: string[],
alertTimestampOverride: Date | undefined,
publicBaseUrl?: string
publicBaseUrl?: string,
intendedTimestamp?: Date
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
intendedTimestamp?: Date
intendedTimestamp: Date | undefined

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed, other places, but here we will have error:
A required parameter cannot follow an optional parameter

Because parameters here is not an object

@nkhristinin
Copy link
Contributor Author

@elasticmachine merge upstream

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
@kbn/rule-data-utils 126 127 +1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
investigateApp 483.2KB 483.3KB +69.0B
observability 467.5KB 467.5KB +44.0B
securitySolution 20.8MB 20.8MB +278.0B
slo 855.2KB 855.2KB +44.0B
synthetics 1.2MB 1.2MB +45.0B
total +480.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
observability 103.7KB 103.8KB +58.0B
slo 24.7KB 24.8KB +58.0B
synthetics 37.1KB 37.1KB +58.0B
total +174.0B
Unknown metric groups

API count

id before after diff
@kbn/rule-data-utils 129 130 +1

History

@nkhristinin nkhristinin merged commit 3d466a7 into elastic:main Oct 14, 2024
45 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/11329624950

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Oct 14, 2024
## Added new field - execution type for alerts

Added new field only for security type alerts:

`kibana.alert.rule.execution.type` - can be `manual` or `scheduled`

Also, move intended timestamp settings from
`create_persistence_rule_type_wrapper` to `build_alert`

Also added those new field to Alert schema and types.

https://github.com/user-attachments/assets/c5b021a6-4763-47ae-b46c-814a138be65a

For tests:

- tests all rule types with and without suppression:
`kibana.alert.rule.execution.type` - should be `scheduled`,
`kibana.alert.intended_timestamp` - should equal alert timestamp

- tests all rules with and without suppression with manual run -
`kibana.alert.rule.execution.type` - should be `manual`,
`kibana.alert.intended_timestamp` - should equal date inside you manual
rule run date range

---------

Co-authored-by: Elastic Machine <[email protected]>
(cherry picked from commit 3d466a7)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Oct 14, 2024
# Backport

This will backport the following commits from `main` to `8.x`:
- [Execution type field
(#195884)](#195884)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Khristinin
Nikita","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-10-14T14:29:12Z","message":"Execution
type field (#195884)\n\n## Added new field - execution type for
alerts\r\n\r\nAdded new field only for security type
alerts:\r\n\r\n`kibana.alert.rule.execution.type` - can be `manual` or
`scheduled`\r\n\r\nAlso, move intended timestamp settings
from\r\n`create_persistence_rule_type_wrapper` to
`build_alert`\r\n\r\nAlso added those new field to Alert schema and
types.\r\n\r\n\r\n\r\nhttps://github.com/user-attachments/assets/c5b021a6-4763-47ae-b46c-814a138be65a\r\n\r\n\r\n\r\nFor
tests:\r\n\r\n- tests all rule types with and without
suppression:\r\n`kibana.alert.rule.execution.type` - should be
`scheduled`,\r\n`kibana.alert.intended_timestamp` - should equal alert
timestamp\r\n\r\n- tests all rules with and without suppression with
manual run -\r\n`kibana.alert.rule.execution.type` - should be
`manual`,\r\n`kibana.alert.intended_timestamp` - should equal date
inside you manual\r\nrule run date
range\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<[email protected]>","sha":"3d466a72a8ab181aadf562ab6c27a5affa32dc96","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","backport:prev-minor"],"title":"Execution
type
field","number":195884,"url":"https://github.com/elastic/kibana/pull/195884","mergeCommit":{"message":"Execution
type field (#195884)\n\n## Added new field - execution type for
alerts\r\n\r\nAdded new field only for security type
alerts:\r\n\r\n`kibana.alert.rule.execution.type` - can be `manual` or
`scheduled`\r\n\r\nAlso, move intended timestamp settings
from\r\n`create_persistence_rule_type_wrapper` to
`build_alert`\r\n\r\nAlso added those new field to Alert schema and
types.\r\n\r\n\r\n\r\nhttps://github.com/user-attachments/assets/c5b021a6-4763-47ae-b46c-814a138be65a\r\n\r\n\r\n\r\nFor
tests:\r\n\r\n- tests all rule types with and without
suppression:\r\n`kibana.alert.rule.execution.type` - should be
`scheduled`,\r\n`kibana.alert.intended_timestamp` - should equal alert
timestamp\r\n\r\n- tests all rules with and without suppression with
manual run -\r\n`kibana.alert.rule.execution.type` - should be
`manual`,\r\n`kibana.alert.intended_timestamp` - should equal date
inside you manual\r\nrule run date
range\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<[email protected]>","sha":"3d466a72a8ab181aadf562ab6c27a5affa32dc96"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/195884","number":195884,"mergeCommit":{"message":"Execution
type field (#195884)\n\n## Added new field - execution type for
alerts\r\n\r\nAdded new field only for security type
alerts:\r\n\r\n`kibana.alert.rule.execution.type` - can be `manual` or
`scheduled`\r\n\r\nAlso, move intended timestamp settings
from\r\n`create_persistence_rule_type_wrapper` to
`build_alert`\r\n\r\nAlso added those new field to Alert schema and
types.\r\n\r\n\r\n\r\nhttps://github.com/user-attachments/assets/c5b021a6-4763-47ae-b46c-814a138be65a\r\n\r\n\r\n\r\nFor
tests:\r\n\r\n- tests all rule types with and without
suppression:\r\n`kibana.alert.rule.execution.type` - should be
`scheduled`,\r\n`kibana.alert.intended_timestamp` - should equal alert
timestamp\r\n\r\n- tests all rules with and without suppression with
manual run -\r\n`kibana.alert.rule.execution.type` - should be
`manual`,\r\n`kibana.alert.intended_timestamp` - should equal date
inside you manual\r\nrule run date
range\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<[email protected]>","sha":"3d466a72a8ab181aadf562ab6c27a5affa32dc96"}}]}]
BACKPORT-->

Co-authored-by: Khristinin Nikita <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) release_note:skip Skip the PR/issue when compiling release notes v8.16.0 v9.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants