Adds update functionality and update route with scripts.

[dhurley14]

Summary

Run ES locally

1. Edit buildSrc/src/main/groovy/elasticsearch.run.gradle and add setting 'xpack.security.authc.api_key.enabled', 'true' after line 24
2. ./gradlew run # this runs with a trial license
3. Execute below curl script to post kibana_elastic user

curl -u elastic:password -X POST "http://127.0.01:9200/_security/user/kibana_elastic?pretty" -H 'Content-Type: application/json' -d '{"password":"changeme","roles":["superuser"],"full_name":"kibana","email":"[email protected]"}'

4. Set kibana.dev.yml to use kibana_elastic as the user

elasticsearch:
  username: 'kibana_elastic'
  password: 'changeme'
  hosts: 'http://127.0.0.1:9200'

APM server

1. download latest apm server from https://github.com/elastic/apm-server/releases and unpack and setup and run ./apm-server -e
2. Create a toy server using the apm setup
3. yarn add elastic-apm-node && yarn add express

const apm = require('elastic-apm-node').start({
serviceName: 'demoapp',
  // Set the custom APM Server URL (default: http://localhost:8200)
  serverUrl: 'http://localhost:8200',

  // Set the service environment
  environment: 'production'
});

const express = require('express');
const app = express();
app.get('/', (req, res) => {
  throw Error('HELLO WORLD!!'); // throw error for apm rule to pickup
});

app.listen(3000, () => console.log('server running on 3000'));

node index.js and server should pring server running on 3000

Start kibana

Set kibana.dev.yml to use kibana_elastic as the user

elasticsearch:
  username: 'kibana_elastic'
  password: 'changeme'
  hosts: 'http://127.0.0.1:9200'

Start up kibana

Go to APM and create an Error count threshold rule looking for one error.

Ping http://localhost:3000 which will throw an error, send it to APM and the apm error count rule will generate an alert and send it to the .kibana-alerts-observability-apm-8.0.0-000001.

Test updating an alert by querying

GET .kibana-<your-name>-alerts*/_search
{
  "query": {
    "match_all": {}
  }
}

grab an ID and send it through the update script like so

term$ cd x-pack/plugins/rule_registry/server/scripts
term$ ./update_observability_alert.sh [\"<some-id>\"] <closed | open>

todo:

• need to figure out how to build index alias name
• figure out why request body is not being passed through to route fixed: b52324f