mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 17:59:23 -04:00
[Response Ops][Maintenance Window] Fix MW bug where rules that generate multiple alerts only has 1 alert that gets muted (#190935)
## Summary Issue: https://github.com/elastic/kibana/issues/190750 Fix a bug with maintenance window where only 1 alert from a rule that generates multiple alerts has the maintenance window ID associated. The fix was to remove a `size` field (not sure why that was there). To verify: 1. Create an active maintenance window with conditional filter 2. Create a rule that matches the maintenance window filter and let it generate multiple alerts (I use ES query rule on the task_manager index with runAt as timefield. Then use groupBy on the runAt field.). 3. Assert that all of the alerts generated have the maintenance window ID associated with it ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
This commit is contained in:
parent
c361abd78c
commit
d0319c6555
4 changed files with 71 additions and 4 deletions
|
@ -324,7 +324,6 @@ export const getQueryByScopedQueries = ({
|
|||
aggs: {
|
||||
alertId: {
|
||||
top_hits: {
|
||||
size: 1,
|
||||
_source: {
|
||||
includes: [ALERT_UUID],
|
||||
},
|
||||
|
|
|
@ -917,7 +917,7 @@ function getAlwaysFiringAlertAsDataRuleType(
|
|||
validate: {
|
||||
params: paramsSchema,
|
||||
},
|
||||
category: 'kibana',
|
||||
category: 'management',
|
||||
producer: 'alertsFixture',
|
||||
defaultActionGroupId: 'default',
|
||||
minimumLicenseRequired: 'basic',
|
||||
|
|
|
@ -8,7 +8,7 @@
|
|||
import expect from '@kbn/expect';
|
||||
import type { Alert } from '@kbn/alerts-as-data-utils';
|
||||
import { ALERT_MAINTENANCE_WINDOW_IDS } from '@kbn/rule-data-utils';
|
||||
import { ObjectRemover } from '../../../../common/lib';
|
||||
import { getTestRuleData, getUrlPrefix, ObjectRemover } from '../../../../common/lib';
|
||||
import { FtrProviderContext } from '../../../../common/ftr_provider_context';
|
||||
import {
|
||||
createRule,
|
||||
|
@ -18,6 +18,7 @@ import {
|
|||
expectNoActionsFired,
|
||||
runSoon,
|
||||
} from './test_helpers';
|
||||
import { Spaces } from '../../../scenarios';
|
||||
|
||||
const alertAsDataIndex = '.internal.alerts-test.patternfiring.alerts-default-000001';
|
||||
|
||||
|
@ -177,5 +178,72 @@ export default function maintenanceWindowScopedQueryTests({ getService }: FtrPro
|
|||
getService,
|
||||
});
|
||||
});
|
||||
|
||||
it('should associate alerts for rules that generate multiple alerts', async () => {
|
||||
await createMaintenanceWindow({
|
||||
supertest,
|
||||
objectRemover,
|
||||
overwrites: {
|
||||
scoped_query: {
|
||||
kql: 'kibana.alert.rule.tags: "test"',
|
||||
filters: [],
|
||||
},
|
||||
category_ids: ['management'],
|
||||
},
|
||||
});
|
||||
|
||||
// Create action and rule
|
||||
const action = await await createAction({
|
||||
supertest,
|
||||
objectRemover,
|
||||
});
|
||||
|
||||
const { body: rule } = await supertestWithoutAuth
|
||||
.post(`${getUrlPrefix(Spaces.space1.id)}/api/alerting/rule`)
|
||||
.set('kbn-xsrf', 'foo')
|
||||
.send(
|
||||
getTestRuleData({
|
||||
name: 'test-rule',
|
||||
rule_type_id: 'test.always-firing-alert-as-data',
|
||||
schedule: { interval: '24h' },
|
||||
tags: ['test'],
|
||||
throttle: undefined,
|
||||
notify_when: 'onActiveAlert',
|
||||
params: {
|
||||
index: alertAsDataIndex,
|
||||
reference: 'test',
|
||||
},
|
||||
actions: [
|
||||
{
|
||||
id: action.id,
|
||||
group: 'default',
|
||||
params: {},
|
||||
},
|
||||
{
|
||||
id: action.id,
|
||||
group: 'recovered',
|
||||
params: {},
|
||||
},
|
||||
],
|
||||
})
|
||||
)
|
||||
.expect(200);
|
||||
|
||||
objectRemover.add(Spaces.space1.id, rule.id, 'rule', 'alerting');
|
||||
|
||||
// Run the first time - active
|
||||
await getRuleEvents({
|
||||
id: rule.id,
|
||||
activeInstance: 2,
|
||||
retry,
|
||||
getService,
|
||||
});
|
||||
|
||||
await expectNoActionsFired({
|
||||
id: rule.id,
|
||||
supertest,
|
||||
retry,
|
||||
});
|
||||
});
|
||||
});
|
||||
}
|
||||
|
|
|
@ -22,7 +22,7 @@ export const createRule = async ({
|
|||
overwrites,
|
||||
}: {
|
||||
actionId: string;
|
||||
pattern: { instance: boolean[] };
|
||||
pattern?: { instance: boolean[] };
|
||||
supertest: SuperTestAgent;
|
||||
objectRemover: ObjectRemover;
|
||||
overwrites?: any;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue