Composite Monitor Meta

[eirsep]

This issue tracks the changes for the development of composite monitors and Alerting workflows
[RFC] Composite Monitors

• Create/update workflow transport action

Validations

• Delegate monitor list cannot be empty
• Same monitor cannot be referenced more than once as a delegate monitor in the same sequence i.e. no duplicate references allowed
• Validate that there are no duplicate numbers or negative numbers in sequence ordering
• Validate monitor marked to pick up chained findings from is doc level or bucket level
• validate delegate monitor Ids are existent monitors

• Workflow model document mappings

• Get workflow transport action

• Delete workflow transport action

  • Delete workflow request supports a flag to delete delegate monitors
  • Validates if user has permissions to delete workflow.
  • If flag to delete delegate monitors is set to true, validates if user has permission to delete monitors
  • If validations fail request is failed with permisison denied error.

• Execute workflow transport action

• Execution Id

  • To ensure we are maintaining a record of all data recorded in one execution of a composite monitor we will introduce the concept of an execution_id.

  • To be able to recognize the findings and alerts generated in the current run a new field execution_id would be added to documents stored in findings indices.

  • Monitor metadata would also store execution_id to account for each of the delegate monitors which are executed.

  • Format of execution_id: Workflow_id+timestamp+random_UUID

  • Where will execution id be stored?

    • findings
    • alerts
    • monitor_metadata: metadata stores information like last seen document sequence number for document monitor or last queried time for bucket/query level monitor
      • Workflow id, monitor id and latest execution id will be persisted in delegate monitor metadata

• Workflow Runner logic

• Chained findings

• Workflow execution id logic and wiring

• Workflow metadata

• rest APis

• secure rest tests

• chained alerts