github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[DOCS] Add example of a rule with errored actions (#162368)

Browse source
This commit is contained in:
Lisa Cawley 2023-07-24 09:00:06 -07:00 • committed by GitHub
parent 3be8f627d7
commit aa4fbc14a9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/user/alerting/create-and-manage-rules.asciidoc
View file

@ -169,9 +169,8 @@ image::images/rules-imported-banner.png[Rules import banner,500]
[[rule-details]]
=== View rule details
You can determine the health of a rule by looking at the *Last response* column
in *{stack-manage-app}* > *{rules-ui}*. A rule can have one of the following
responses:
You can determine the health of a rule by looking at the *Last response* in *{stack-manage-app}* > *{rules-ui}*.
A rule can have one of the following responses:
`failed`:: The rule ran with errors.
`succeeded`:: The rule ran without errors.
@ -193,6 +192,14 @@ When an alert is created, it generates actions. If the conditions that caused th
NOTE: The `flapping` state is possible only if you have enabled alert flapping detection in *{stack-manage-app}* > *{rules-ui}* > *Settings*. For each space, you can choose a look back window and threshold that are used to determine whether alerts are flapping. For example, you can specify that the alert must change status at least 6 times in the last 10 runs. If the rule has actions that run when the alert status changes, those actions are suppressed while the alert is flapping.
If there are rule actions that failed to run successfully, you can see the details on the *History* tab.
In the *Message* column, click the warning or expand icon image:images/expand-icon-2.png[double arrow icon to open a flyout with the document details] or click the number in the *Errored actions* column to open the *Errored Actions* panel.
In this example, the action failed because the <<action-config-email-domain-allowlist,`xpack.actions.email.domain_allowlist`>> setting was updated and the action's email recipient is no longer included in the allowlist:
[role="screenshot"]
image::images/rule-details-errored-actions.png[Rule histor page with alerts that have errored actions]
// NOTE: This is an autogenerated screenshot. Do not edit it directly.
If an alert was affected by a maintenance window, its identifier appears in the *Maintenance windows* column.
For more information about their impact on alert notifications, refer to <<maintenance-windows>>.

BIN
docs/user/alerting/images/rule-details-errored-actions.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 382 KiB