Edit UI text for "exclude previous hits" check box in Elasticsearch query rule (#140146)

This commit is contained in:
Lisa Cawley 2022-09-07 08:34:35 -07:00 committed by GitHub
parent abfca67f6b
commit 2115309d0a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 23 additions and 33 deletions

Binary file not shown.

Before

Width:  |  Height:  |  Size: 129 KiB

After

Width:  |  Height:  |  Size: 344 KiB

Before After
Before After

View file

@ -87,5 +87,5 @@ they are not visible in *{stack-manage-app} > {rules-ui}*.
==============================================
include::rule-types/index-threshold.asciidoc[]
include::rule-types/es-query.asciidoc[]
include::rule-types/es-query.asciidoc[leveloffset=+1]
include::rule-types/geo-rule-types.asciidoc[]

View file

@ -1,6 +1,5 @@
[[rule-type-es-query]]
[role="xpack"]
=== {es} query
== {es} query
The {es} query rule type runs a user-configured query, compares the number of
matches to a configured threshold, and schedules actions to run when the
@ -8,14 +7,14 @@ threshold condition is met.
[float]
==== Create the rule
=== Create the rule
Fill in the <<defining-rules-general-details, rule details>>, then select
*{es} query*.
[float]
==== Define the conditions
=== Define the conditions
Define properties to detect the condition.
@ -38,11 +37,11 @@ Time window:: Defines how far back to search for documents, using the
value higher than the *check every* value in the
<<defining-rules-general-details, general rule details>>, to avoid gaps in
detection.
Exclude the hits from previous run:: Turn on to avoid alert duplication by
Exclude matches from previous run:: Turn on to avoid alert duplication by
excluding documents that have already been detected by the previous rule run.
[float]
==== Add action variables
=== Add action variables
<<defining-rules-actions-details, Add an action>> to run when the rule condition
is met. The following variables are specific to the {es} query rule. You can
@ -109,7 +108,7 @@ Labels:
--
[float]
==== Test your query
=== Test your query
Use the *Test query* feature to verify that your query DSL is valid.
@ -125,11 +124,12 @@ image::user/alerting/images/rule-types-es-query-valid.png[Test {es} query return
image::user/alerting/images/rule-types-es-query-invalid.png[Test {es} query shows error when invalid]
[float]
==== Handling multiple matches of the same document
=== Handling multiple matches of the same document
This rule type checks for duplication of document matches across multiple runs.
If you configure the rule with a schedule interval smaller than the time window,
and a document matches a query in multiple runs, it is alerted on only once.
By default, *Exclude matches from previous run* is turned on and the rule checks
for duplication of document matches across multiple runs. If you configure the
rule with a schedule interval smaller than the time window and a document
matches a query in multiple runs, it is alerted on only once.
The rule uses the timestamp of the matches to avoid alerting on the same match
multiple times. The timestamp of the latest match is used for evaluating the

View file

@ -145,7 +145,7 @@ export const RuleCommonExpressions: React.FC<RuleCommonExpressionsProps> = ({
onChangeExcludeHitsFromPreviousRun(event.target.checked);
}}
label={i18n.translate('xpack.stackAlerts.esQuery.ui.excludePreviousHitsExpression', {
defaultMessage: 'Exclude the hits from previous rule runs',
defaultMessage: 'Exclude matches from previous runs',
})}
/>
</EuiFormRow>

View file

@ -6,14 +6,7 @@
*/
import React, { Component } from 'react';
import {
EuiButtonIcon,
EuiPopover,
EuiPopoverTitle,
EuiText,
EuiCallOut,
EuiSpacer,
} from '@elastic/eui';
import { EuiButtonIcon, EuiPopover, EuiPopoverTitle, EuiText } from '@elastic/eui';
import { FormattedMessage } from '@kbn/i18n-react';
import { i18n } from '@kbn/i18n';
import { css } from '@emotion/react';
@ -66,16 +59,16 @@ export class QueryThresholdHelpPopover extends Component<{}, State> {
}}
/>
</p>
<p>
<FormattedMessage
id="xpack.stackAlerts.esQuery.ui.thresholdHelp.duplicateMatches"
defaultMessage="If {excludePrevious} is turned on, a document that matches the query in multiple runs will be used in only the first threshold calculation."
values={{
excludePrevious: <b>Exclude matches from previous runs</b>,
}}
/>
</p>
</EuiText>
<EuiSpacer size="m" />
<EuiCallOut
iconType="pin"
size="s"
title={i18n.translate('xpack.stackAlerts.esQuery.ui.thresholdHelp.duplicateMatches', {
defaultMessage:
"If the 'Exclude the hits from previous rule runs' option is checked and the time window is greater than the check interval, a document that matches the query in multiple runs will be used in only the first threshold calculation.",
})}
/>
</div>
);
}

View file

@ -30322,7 +30322,6 @@
"xpack.stackAlerts.esQuery.ui.testQuery": "Tester la recherche",
"xpack.stackAlerts.esQuery.ui.testQueryIsExecuted": "La requête a été exécutée.",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.ariaLabel": "Aide",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.duplicateMatches": "Si la fenêtre de temps est supérieure à l'intervalle de vérification et qu'un document correspond à la requête dans plusieurs exécutions, il n'est utilisé que dans le premier calcul du seuil.",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.threshold": "Chaque fois que la règle s'exécute, elle vérifie si le nombre de documents qui correspondent à votre requête atteint ce seuil.",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.title": "Définir le seuil et la fenêtre de temps",
"xpack.stackAlerts.esQuery.ui.validation.error.greaterThenThreshold0Text": "Seuil 1 doit être supérieur à Seuil 0.",

View file

@ -30298,7 +30298,6 @@
"xpack.stackAlerts.esQuery.ui.testQuery": "クエリのテスト",
"xpack.stackAlerts.esQuery.ui.testQueryIsExecuted": "クエリが実行されます。",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.ariaLabel": "ヘルプ",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.duplicateMatches": "時間枠がチェック間隔より長く、ドキュメントが複数の実行でクエリと一致する場合、最初のしきい値計算でのみ使用されます。",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.threshold": "ルールが実行されるたびに、クエリと一致するドキュメントの数がこのしきい値を満たすかどうかが確認されます。",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.title": "しきい値と時間枠を設定",
"xpack.stackAlerts.esQuery.ui.validation.error.greaterThenThreshold0Text": "しきい値1はしきい値0より大きくなければなりません。",

View file

@ -30330,7 +30330,6 @@
"xpack.stackAlerts.esQuery.ui.testQuery": "测试查询",
"xpack.stackAlerts.esQuery.ui.testQueryIsExecuted": "已执行查询。",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.ariaLabel": "帮助",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.duplicateMatches": "如果时间窗口大于检查时间间隔且文档在多次运行时与查询匹配,则仅将其用在第一次阈值计算期间。",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.threshold": "每次运行规则时,都会检查与查询匹配的文档数目是否与此阈值相符。",
"xpack.stackAlerts.esQuery.ui.thresholdHelp.title": "设置阈值和时间窗口",
"xpack.stackAlerts.esQuery.ui.validation.error.greaterThenThreshold0Text": "阈值 1 必须 > 阈值 0。",