github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 09:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Response Ops][Docs] Adding user facing docs for rule cancellation (#128677)

Browse source 
* Adding words

* PR feedback

* Update docs/user/alerting/troubleshooting/alerting-common-issues.asciidoc

Co-authored-by: Mike Côté <mikecote@users.noreply.github.com>

Co-authored-by: Mike Côté <mikecote@users.noreply.github.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
Ying Mao 2022-04-05 07:49:45 -04:00 • committed by GitHub
parent 0a4f0fc504
commit 873849d527
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 19 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

BIN
docs/user/alerting/images/rule-details-timeout-error.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 78 KiB

22
docs/user/alerting/troubleshooting/alerting-common-issues.asciidoc
View file

@ -64,7 +64,7 @@ see <<action-settings,Action settings>>.
*Problem*
Rules are taking a long time to execute and are impacting the overall health of your deployment.
Rules are taking a long time to execute and are impacting the overall health of your deployment.
[IMPORTANT]
==============================================
@ -73,7 +73,23 @@ By default, only users with a `superuser` role can query the experimental[] {kib
*Solution*
Query for a list of rule ids, bucketed by their execution times:
By default, rules have a `5m` timeout. Rules that run longer than this timeout are automatically cancelled to prevent them from consuming too much of {kib}'s resources. Alerts and actions that may have been scheduled before the rule timed out are discarded. When a rule times out, you will see this error in the {kib} logs:
[source,sh]
--------------------------------------------------
[2022-03-28T13:14:04.062-04:00][WARN ][plugins.taskManager] Cancelling task alerting:.index-threshold "a6ea0070-aec0-11ec-9985-dd576a3fe205" as it expired at 2022-03-28T17:14:03.980Z after running for 05m 10s (with timeout set at 5m).
--------------------------------------------------
and in the <<rule-details,details page>>:
[role="screenshot"]
image::images/rule-details-timeout-error.png[Rule details page with timeout error]
If you want your rules to run longer, update the `xpack.alerting.rules.execution.timeout` configuration in your <<alert-settings>>. You can also target a specific rule type by using `xpack.alerting.rules.execution.ruleTypeOverrides`.
Rules that consistently run longer than their <<create-edit-rules, check interval>> may produce unexpected results. If the average run duration, visible on the <<rule-details,details page>>, is greater than the check interval, consider increasing the check interval.
To get all long-running rules, you can query for a list of rule ids, bucketed by their execution times:
[source,console]
--------------------------------------------------
@ -228,7 +244,7 @@ Use the <<get-rule-api,Get Rule API>> to retrieve additional information about r
[float]
[[rule-cannot-decrypt-api-key]]
=== Rule cannot decrypt apiKey
==== Rule cannot decrypt apiKey
*Problem*: