github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[8.16] [Custom threshold] Fix using data view runtime fields during rule execution for the custom threshold rule (#209133) (#209287)

Browse source 
# Backport

This will backport the following commits from `main` to `8.16`:
- [[Custom threshold] Fix using data view runtime fields during rule
execution for the custom threshold rule
(#209133)](https://github.com/elastic/kibana/pull/209133)

<!--- Backport version: 9.6.4 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maryam
Saeidi","email":"maryam.saeidi@elastic.co"},"sourceCommit":{"committedDate":"2025-02-03T11:09:29Z","message":"[Custom
threshold] Fix using data view runtime fields during rule execution for
the custom threshold rule (#209133)\n\nFixes #200772\r\n\r\n## 🐉
Summary\r\n\r\n\r\nThis PR fixes supporting data view runtime fields
during rule execution\r\nfor the custom threshold rule.\r\n\r\n## 🧪 How
to test\r\n\r\n1. Create a runtime field as shown below:\r\n\r\n
|Runtime field| Preview|\r\n
|---|---|\r\n\r\n|![Image](e93efad5-bc3b-4306-b820-8b096dbba360)|\r\n\r\n2.
Make sure alerts are generated as expected both for regular
and\r\nno-data
alerts:\r\n\r\n![image](https://github.com/user-attachments/assets/a2174e40-11a4-4d75-8500-bfce126ba7cd)\r\n\r\n###
TODO\r\n- [x] Add an API integration test\r\n - [x] Test on
MKI","sha":"8fe5738b24048972f801dc96e243d5a3d5d72eb3","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","backport:prev-major","ci:project-deploy-observability","Team:obs-ux-management","v9.1.0"],"title":"[Custom
threshold] Fix using data view runtime fields during rule execution for
the custom threshold
rule","number":209133,"url":"https://github.com/elastic/kibana/pull/209133","mergeCommit":{"message":"[Custom
threshold] Fix using data view runtime fields during rule execution for
the custom threshold rule (#209133)\n\nFixes #200772\r\n\r\n## 🐉
Summary\r\n\r\n\r\nThis PR fixes supporting data view runtime fields
during rule execution\r\nfor the custom threshold rule.\r\n\r\n## 🧪 How
to test\r\n\r\n1. Create a runtime field as shown below:\r\n\r\n
|Runtime field| Preview|\r\n
|---|---|\r\n\r\n|![Image](e93efad5-bc3b-4306-b820-8b096dbba360)|\r\n\r\n2.
Make sure alerts are generated as expected both for regular
and\r\nno-data
alerts:\r\n\r\n![image](https://github.com/user-attachments/assets/a2174e40-11a4-4d75-8500-bfce126ba7cd)\r\n\r\n###
TODO\r\n- [x] Add an API integration test\r\n - [x] Test on
MKI","sha":"8fe5738b24048972f801dc96e243d5a3d5d72eb3"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/209133","number":209133,"mergeCommit":{"message":"[Custom
threshold] Fix using data view runtime fields during rule execution for
the custom threshold rule (#209133)\n\nFixes #200772\r\n\r\n## 🐉
Summary\r\n\r\n\r\nThis PR fixes supporting data view runtime fields
during rule execution\r\nfor the custom threshold rule.\r\n\r\n## 🧪 How
to test\r\n\r\n1. Create a runtime field as shown below:\r\n\r\n
|Runtime field| Preview|\r\n
|---|---|\r\n\r\n|![Image](e93efad5-bc3b-4306-b820-8b096dbba360)|\r\n\r\n2.
Make sure alerts are generated as expected both for regular
and\r\nno-data
alerts:\r\n\r\n![image](https://github.com/user-attachments/assets/a2174e40-11a4-4d75-8500-bfce126ba7cd)\r\n\r\n###
TODO\r\n- [x] Add an API integration test\r\n - [x] Test on
MKI","sha":"8fe5738b24048972f801dc96e243d5a3d5d72eb3"}},{"url":"https://github.com/elastic/kibana/pull/209253","number":209253,"branch":"8.18","state":"OPEN"},{"url":"https://github.com/elastic/kibana/pull/209254","number":209254,"branch":"8.x","state":"OPEN"},{"url":"https://github.com/elastic/kibana/pull/209280","number":209280,"branch":"8.17","state":"OPEN"}]}]
BACKPORT-->
This commit is contained in:
Maryam Saeidi 2025-02-04 17:16:27 +01:00 • committed by GitHub
parent 31b8f94692
commit d915fd29c4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 113 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/custom_threshold_executor.test.ts
View file

@ -154,6 +154,7 @@ const mockedIndex = {
const mockedDataView = {
getIndexPattern: () => 'mockedIndexPattern',
getName: () => 'mockedDataViewName',
getRuntimeMappings: () => undefined,
...mockedIndex,
};
const mockedSearchSource = {
@ -970,7 +971,7 @@ describe('The custom threshold alert type', () => {
stateResult2
);
expect(stateResult3.missingGroups).toEqual([{ key: 'b', bucketKey: { groupBy0: 'b' } }]);
expect(mockedEvaluateRule.mock.calls[2][10]).toEqual([
expect(mockedEvaluateRule.mock.calls[2][11]).toEqual([
{ bucketKey: { groupBy0: 'b' }, key: 'b' },
]);
});
@ -2959,7 +2960,7 @@ describe('The custom threshold alert type', () => {
stateResult2
);
expect(stateResult3.missingGroups).toEqual([{ key: 'b', bucketKey: { groupBy0: 'b' } }]);
expect(mockedEvaluateRule.mock.calls[2][10]).toEqual([
expect(mockedEvaluateRule.mock.calls[2][11]).toEqual([
{ bucketKey: { groupBy0: 'b' }, key: 'b' },
]);
});

2
x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/custom_threshold_executor.ts
View file

@ -126,6 +126,7 @@ export const createCustomThresholdExecutor = ({
const initialSearchSource = await searchSourceClient.create(params.searchConfiguration);
const dataView = initialSearchSource.getField('index')!;
const { id: dataViewId, timeFieldName } = dataView;
const runtimeMappings = dataView.getRuntimeMappings();
const dataViewIndexPattern = dataView.getIndexPattern();
const dataViewName = dataView.getName();
if (!dataViewIndexPattern) {
@ -147,6 +148,7 @@ export const createCustomThresholdExecutor = ({
logger,
{ end: dateEnd, start: dateStart },
esQueryConfig,
runtimeMappings,
state.lastRunTimestamp,
previousMissingGroups
);

6
x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/check_missing_group.ts
View file

@ -5,6 +5,7 @@
* 2.0.
*/
import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
import type { ElasticsearchClient } from '@kbn/core/server';
import type { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
import type { EsQueryConfig } from '@kbn/es-query';
@ -16,6 +17,7 @@ import {
} from '../../../../../common/custom_threshold_rule/types';
import type { BucketKey } from './get_data';
import { calculateCurrentTimeFrame, createBoolQuery } from './metric_query';
import { isPopulatedObject } from './is_populated_object';
export interface MissingGroupsRecord {
key: string;
@ -32,7 +34,8 @@ export const checkMissingGroups = async (
logger: Logger,
timeframe: { start: number; end: number },
esQueryConfig: EsQueryConfig,
missingGroups: MissingGroupsRecord[] = []
missingGroups: MissingGroupsRecord[] = [],
runtimeMappings?: estypes.MappingRuntimeFields
): Promise<MissingGroupsRecord[]> => {
if (missingGroups.length === 0) {
return missingGroups;
@ -65,6 +68,7 @@ export const checkMissingGroups = async (
terminate_after: 1,
track_total_hits: true,
query,
...(isPopulatedObject(runtimeMappings) ? { runtime_mappings: runtimeMappings } : {}),
},
];
});

6
x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/evaluate_rule.ts
View file

@ -6,6 +6,7 @@
*/
import moment from 'moment';
import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
import type { ElasticsearchClient } from '@kbn/core/server';
import { EsQueryConfig } from '@kbn/es-query';
import type { Logger } from '@kbn/logging';
@ -45,6 +46,7 @@ export const evaluateRule = async <Params extends EvaluatedRuleParams = Evaluate
logger: Logger,
timeframe: { start: string; end: string },
esQueryConfig: EsQueryConfig,
runtimeMappings?: estypes.MappingRuntimeFields,
lastPeriodEnd?: number,
missingGroups: MissingGroupsRecord[] = []
): Promise<Array<Record<string, Evaluation>>> => {
@ -77,6 +79,7 @@ export const evaluateRule = async <Params extends EvaluatedRuleParams = Evaluate
alertOnGroupDisappear,
calculatedTimerange,
logger,
runtimeMappings,
lastPeriodEnd
);
@ -90,7 +93,8 @@ export const evaluateRule = async <Params extends EvaluatedRuleParams = Evaluate
logger,
calculatedTimerange,
esQueryConfig,
missingGroups
missingGroups,
runtimeMappings
);
for (const missingGroup of verifiedMissingGroups) {

4
x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/get_data.ts
View file

@ -6,6 +6,7 @@
*/
import type { SearchResponse, AggregationsAggregate } from '@elastic/elasticsearch/lib/api/types';
import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
import type { ElasticsearchClient } from '@kbn/core/server';
import type { EsQueryConfig } from '@kbn/es-query';
import type { Logger } from '@kbn/logging';
@ -110,6 +111,7 @@ export const getData = async (
alertOnGroupDisappear: boolean,
timeframe: { start: number; end: number },
logger: Logger,
runtimeMappings?: estypes.MappingRuntimeFields,
lastPeriodEnd?: number,
previousResults: GetDataResponse = {},
afterKey?: Record<string, string>
@ -170,6 +172,7 @@ export const getData = async (
alertOnGroupDisappear,
timeframe,
logger,
runtimeMappings,
lastPeriodEnd,
previous,
nextAfterKey
@ -209,6 +212,7 @@ export const getData = async (
alertOnGroupDisappear,
searchConfiguration,
esQueryConfig,
runtimeMappings,
lastPeriodEnd,
groupBy,
afterKey,

52
x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/is_populated_object.test.ts Normal file
View file

@ -0,0 +1,52 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
import { isPopulatedObject } from './is_populated_object';
describe('isPopulatedObject', () => {
it('does not allow numbers', () => {
expect(isPopulatedObject(0)).toBe(false);
});
it('does not allow strings', () => {
expect(isPopulatedObject('')).toBe(false);
});
it('does not allow null', () => {
expect(isPopulatedObject(null)).toBe(false);
});
it('does not allow an empty object', () => {
expect(isPopulatedObject({})).toBe(false);
});
it('allows an object with an attribute', () => {
expect(isPopulatedObject({ attribute: 'value' })).toBe(true);
});
it('does not allow an object with a non-existing required attribute', () => {
expect(isPopulatedObject({ attribute: 'value' }, ['otherAttribute'])).toBe(false);
});
it('allows an object with an existing required attribute', () => {
expect(isPopulatedObject({ attribute: 'value' }, ['attribute'])).toBe(true);
});
it('allows an object with two existing required attributes', () => {
expect(
isPopulatedObject({ attribute1: 'value1', attribute2: 'value2' }, [
'attribute1',
'attribute2',
])
).toBe(true);
});
it('does not allow an object with two required attributes where one does not exist', () => {
expect(
isPopulatedObject({ attribute1: 'value1', attribute2: 'value2' }, [
'attribute1',
'otherAttribute',
])
).toBe(false);
});
it('does not allow an object with a required attribute in the prototype ', () => {
const testObject = { attribute: 'value', __proto__: { otherAttribute: 'value' } };
expect(isPopulatedObject(testObject, ['otherAttribute'])).toBe(false);
});
});

35
x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/is_populated_object.ts Normal file
View file

@ -0,0 +1,35 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/
/**
* A type guard to check record like object structures.
*
* Examples:
* - `isPopulatedObject({...})`
* Limits type to Record<string, unknown>
*
* - `isPopulatedObject({...}, ['attribute'])`
* Limits type to Record<'attribute', unknown>
*
* - `isPopulatedObject<keyof MyInterface>({...})`
* Limits type to a record with keys of the given interface.
* Note that you might want to add keys from the interface to the
* array of requiredAttributes to satisfy runtime requirements.
* Otherwise you'd just satisfy TS requirements but might still
* run into runtime issues.
*/
export const isPopulatedObject = <U extends string = string, T extends unknown = unknown>(
arg: unknown,
requiredAttributes: U[] = []
): arg is Record<U, T> => {
return (
typeof arg === 'object' &&
arg !== null &&
Object.keys(arg).length > 0 &&
(requiredAttributes.length === 0 || requiredAttributes.every((d) => Object.hasOwn(arg, d)))
);
};

3
x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/metric_query.test.ts
View file

@ -64,6 +64,7 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
true,
searchConfiguration,
esQueryConfig,
undefined,
void 0,
groupBy
);
@ -121,6 +122,7 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
true,
currentSearchConfiguration,
esQueryConfig,
undefined,
void 0,
groupBy
);
@ -233,6 +235,7 @@ describe("The Metric Threshold Alert's getElasticsearchMetricQuery", () => {
true,
currentSearchConfiguration,
esQueryConfig,
undefined,
void 0,
groupBy
);

4
x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/lib/metric_query.ts
View file

@ -6,6 +6,7 @@
*/
import moment from 'moment';
import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/types';
import type { EsQueryConfig, Filter } from '@kbn/es-query';
import {
@ -24,6 +25,7 @@ import {
} from '../utils';
import { createBucketSelector } from './create_bucket_selector';
import { wrapInCurrentPeriod } from './wrap_in_period';
import { isPopulatedObject } from './is_populated_object';
export const calculateCurrentTimeFrame = (
metricParams: CustomMetricExpressionParams,
@ -76,6 +78,7 @@ export const getElasticsearchMetricQuery = (
alertOnGroupDisappear: boolean,
searchConfiguration: SearchConfigurationType,
esQueryConfig: EsQueryConfig,
runtimeMappings?: estypes.MappingRuntimeFields,
lastPeriodEnd?: number,
groupBy?: string | string[],
afterKey?: Record<string, string>,
@ -211,6 +214,7 @@ export const getElasticsearchMetricQuery = (
return {
track_total_hits: true,
query,
...(isPopulatedObject(runtimeMappings) ? { runtime_mappings: runtimeMappings } : {}),
size: 0,
aggs,
};