Commit graph

111 commits

Author SHA1 Message Date
Kibana Machine
a4a3562091
[8.8] [Discover][Alerts] Make alert links shorter (#158582) (#158693)
# Backport

This will backport the following commits from `main` to `8.8`:
- [[Discover][Alerts] Make alert links shorter
(#158582)](https://github.com/elastic/kibana/pull/158582)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Julia
Rechkunova","email":"julia.rechkunova@elastic.co"},"sourceCommit":{"committedDate":"2023-05-31T05:28:35Z","message":"[Discover][Alerts]
Make alert links shorter (#158582)\n\n- Addresses
https://github.com/elastic/kibana/issues/158262\r\n\r\n##
Summary\r\n\r\nThis PR makes alert links shorter by removing redundant
props from the\r\nencoded state. We should trim it down more in the
future. Backporting a\r\nsmall fix for now.\r\n\r\nFor
testing:\r\nPlease follow instructions from this PR
description\r\nhttps://github.com/elastic/kibana/pull/146403","sha":"ef07c978689872d2ae3037aa06a0f2f7b23c3582","branchLabelMapping":{"^v8.9.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:DataDiscovery","backport:prev-minor","v8.9.0"],"number":158582,"url":"https://github.com/elastic/kibana/pull/158582","mergeCommit":{"message":"[Discover][Alerts]
Make alert links shorter (#158582)\n\n- Addresses
https://github.com/elastic/kibana/issues/158262\r\n\r\n##
Summary\r\n\r\nThis PR makes alert links shorter by removing redundant
props from the\r\nencoded state. We should trim it down more in the
future. Backporting a\r\nsmall fix for now.\r\n\r\nFor
testing:\r\nPlease follow instructions from this PR
description\r\nhttps://github.com/elastic/kibana/pull/146403","sha":"ef07c978689872d2ae3037aa06a0f2f7b23c3582"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.9.0","labelRegex":"^v8.9.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/158582","number":158582,"mergeCommit":{"message":"[Discover][Alerts]
Make alert links shorter (#158582)\n\n- Addresses
https://github.com/elastic/kibana/issues/158262\r\n\r\n##
Summary\r\n\r\nThis PR makes alert links shorter by removing redundant
props from the\r\nencoded state. We should trim it down more in the
future. Backporting a\r\nsmall fix for now.\r\n\r\nFor
testing:\r\nPlease follow instructions from this PR
description\r\nhttps://github.com/elastic/kibana/pull/146403","sha":"ef07c978689872d2ae3037aa06a0f2f7b23c3582"}}]}]
BACKPORT-->

Co-authored-by: Julia Rechkunova <julia.rechkunova@elastic.co>
2023-05-31 00:24:39 -07:00
Kibana Machine
f61bbf3009
[8.8] [ResponseOps] es query rule params not compatible between 8.6 and 8.7 (#157710) (#157775)
# Backport

This will backport the following commits from `main` to `8.8`:
- [[ResponseOps] es query rule params not compatible between 8.6 and 8.7
(#157710)](https://github.com/elastic/kibana/pull/157710)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Alexi
Doak","email":"109488926+doakalexi@users.noreply.github.com"},"sourceCommit":{"committedDate":"2023-05-15T17:08:30Z","message":"[ResponseOps]
es query rule params not compatible between 8.6 and 8.7
(#157710)\n\nResolves
https://github.com/elastic/kibana/issues/156856\r\n\r\n##
Summary\r\n\r\nAdds a default value to `aggType` and `groupBy` fields
\r\n\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"8ecd2d67a02f9de2a0e4f8778dcca3781dceaa90","branchLabelMapping":{"^v8.9.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:skip","Team:ResponseOps","v8.8.0","v8.9.0"],"number":157710,"url":"https://github.com/elastic/kibana/pull/157710","mergeCommit":{"message":"[ResponseOps]
es query rule params not compatible between 8.6 and 8.7
(#157710)\n\nResolves
https://github.com/elastic/kibana/issues/156856\r\n\r\n##
Summary\r\n\r\nAdds a default value to `aggType` and `groupBy` fields
\r\n\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"8ecd2d67a02f9de2a0e4f8778dcca3781dceaa90"}},"sourceBranch":"main","suggestedTargetBranches":["8.8"],"targetPullRequestStates":[{"branch":"8.8","label":"v8.8.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.9.0","labelRegex":"^v8.9.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/157710","number":157710,"mergeCommit":{"message":"[ResponseOps]
es query rule params not compatible between 8.6 and 8.7
(#157710)\n\nResolves
https://github.com/elastic/kibana/issues/156856\r\n\r\n##
Summary\r\n\r\nAdds a default value to `aggType` and `groupBy` fields
\r\n\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"8ecd2d67a02f9de2a0e4f8778dcca3781dceaa90"}}]}]
BACKPORT-->

Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
2023-05-15 11:13:09 -07:00
Garrett Spong
ef64acf405
[RAM] Adds revision to event-log (#153716)
## Summary

Follow on from https://github.com/elastic/kibana/pull/151388 &
https://github.com/elastic/kibana/pull/147398, which includes the rule's
current `revision` when writing to the kibana event-log.

Note: Added as `kibana.alert.rule.revision` instead of as ECS field
`rule.version` as the [ECS
docs](https://www.elastic.co/guide/en/ecs/current/ecs-rule.html#field-rule-version)
conflate `version` & `revision` and figured it was best to be explicit.
If we do indeed want to use `rule.version` I'll make the change.


<p align="center">
<img width="500"
src="https://user-images.githubusercontent.com/2946766/233216775-f371f412-dcf6-4ef7-a396-84ec853eebbb.png"
/>
</p> 



### Checklist

Delete any items that are not applicable to this PR.

- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2023-04-21 17:20:26 -07:00
Ersin Erdal
00dfae4312
Make rule type param validation required (#154257)
Resolves: #153755

This PR intends to make rule type param validation function required.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-04-20 19:23:47 +02:00
Garrett Spong
e41cc7ad1c
[RAM] Adds revision to alerts schema (#151388)
## Summary

Follow up from https://github.com/elastic/kibana/pull/147398, which adds
`revision` to the alerts schema so the rule's current revision is
included when creating alerts.

In Security Solution:
<p align="center">
<img width="500"
src="https://user-images.githubusercontent.com/2946766/227386305-c8afe295-b79b-4b28-838a-cc3bed0f3eda.png"
/>
</p>

In Observability:
<p align="center">
<img width="500"
src="https://user-images.githubusercontent.com/2946766/227577019-05307860-e0e3-4e1e-b4cf-604bdb52afdf.png"
/>
</p>



Note: this was originally a branched off
https://github.com/elastic/kibana/pull/147398, so the large commit list
is resulting from there as Github doesn't seem to re-write after after a
rebase w/ `main` and a force push.


### Checklist

Delete any items that are not applicable to this PR.

- [ ]
~[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials~
* Base docs to be added for
https://github.com/elastic/kibana/pull/147398
- [X] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2023-03-29 19:28:02 +00:00
Jiawei Wu
cfd0e8731a
[RAM] Add strict_date_optional_time to excludeHitsFromPreviousRun time range query for ES query rule (#151958)
## Summary
Resolves: https://github.com/elastic/kibana/issues/150448

Adds `strict_date_optional_time` to the `excludeHitsFromPreviousRun`
last timestamp range query to allow querying data views with non-ISO
`timefields`. This fixes the crash that occurred when we didn't have
this field when the ES query ran consecutively to exclude previous hits
for data views with non-iso time fields.

### To test:

##### 1. Create mapping with date with non-ISO format
```
PUT test-index
{
  "mappings": {
    "properties": {
      "date": {
        "type": "date",
        "format": "epoch_second"
      },
      "test_field": {
        "type": "keyword"
      }
    }
  }
}
```
##### 2. Insert test data
```
PUT test-index/_bulk?refresh
{ "index" : { "_id" : "1" } }
{ "date": 1677105176, "test_field": "hi"}
{ "index" : { "_id" : "2" } }
{ "date": 1677108776, "test_field": "bye"}
```

##### 3. Create data view with the `date` as the time field.

##### 4. Create a Elasticsearch query rule with KQL, making sure
`Exclude matches from previous runs` is checked. Let rule run twice to
generate alerts

##### 5. The rule should run without errors (especially after the first
run). Before this fix, the rule would error after 1 run.

### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2023-02-27 10:14:12 -08:00
Ersin Erdal
58204cf2a0
Add date_nanos support to Time field (#151374)
Fixes: #145855 

`Time field` in rule update/create forms shows only the fields with
`date` data type. This PR adds `date_nanos` type as well.

## To verify:

- Create an index that has fields with `date` and `date_nanos` types.
```
PUT test-index-date
{
  "mappings": {
    "properties": {
      "date": {
        "type": "date"
      },
      "timestamp": {
        "type": "date_nanos"
      }
    }
  }
}
```
- Add data with `date` and `date_nanos` data types
Note: You can use
https://www.site24x7.com/tools/time-stamp-converter.html address to
generate date_nanos timestamps with a date you desired.
```
PUT test-index-date/_bulk?refresh
{ "index" : { "_id" : "1" } }
{ "date": "2023-02-15T18:00:00.000Z", "timestamp": 1676480400000} 
{ "index" : { "_id" : "2" } }
{ "date": "2023-02-15T18:00:00.000Z", "timestamp": 1676480400000 } 
```
- Open a Rule create form and select `Elasticsearch query`
- Select `Query DSL`
- Click on `select an index`
- Type the above index name (test-index-date) in `Indices to query`
input
- Select `timestamp` from time field
- Click on `Test Query` button and expect to see `Query matched 2
documents in the last 5m.`
2023-02-21 16:25:09 +01:00
Julia Rechkunova
17ab3a31dd
[Discover] Fix Elasticsearch query rule for "KQL or Lucene" query without filters (#151632)
Closes https://github.com/elastic/kibana/issues/151609 

For testing:
- Go to Rule Management page
- Create a new Rule with "Elasticsearch query" type in "KQL or Lucene"
format
- Save and check the status after the rule finishes the creating process
=> It should say "Succeeded"
2023-02-21 06:46:42 -07:00
Alexi Doak
467891e760
[ResponseOps] [Alerting] Add warning to Edit Rule Flyout when publicUrl is not configured (#149832)
Resolves https://github.com/elastic/kibana/issues/144890

## Summary

Added a warning to the rule flyout that will warn users about using
`context.alertDetailsUrl` and `context.viewInAppUrl` in an input or text
area when they do not have `publicUrl` set in their kibana config.

**Warning:**
<img width="605" alt="Screen Shot 2023-02-01 at 11 18 17 AM"
src="https://user-images.githubusercontent.com/109488926/216102190-f41b4af0-5e40-4529-8668-68e2f57c5046.png">

<img width="586" alt="Screen Shot 2023-02-01 at 11 18 26 AM"
src="https://user-images.githubusercontent.com/109488926/217331719-2f5b18e3-62e8-42be-b389-101538e05b9b.png">

### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### To verify

- Remove your kibana config for `server.publicBaseUrl`, and create a
rule with a connector. Add the context variables
`context.alertDetailsUrl` or `context.viewInAppUrl` and verify that a
warning shows up in the form.
- Add `server.publicBaseUrl` to your kibana config, and create a rule
with a connector. Add the context variables `context.alertDetailsUrl` or
`context.viewInAppUrl` and verify that a warning shows does **not** show
in the form.
- You should try this for multiple connectors to verify that the
warnings are configured correctly for them.
2023-02-15 12:53:38 -08:00
Xavier Mouligneau
585d3f0528
[RAM] Add integrated snooze component for security solution (#149752)
## Summary

We wanted to avoid duplication of code so we created a more integrated
component with API to snooze rule. we also added the information about
snooze in the task runner so security folks can manage their legacy
actions in the execution rule, it will looks like that
```ts
import { isRuleSnoozed } from '@kbn/alerting-plugin/server';

if (actions.length && !isRuleSnoozed(options.rule)) {
...
}
```

One way to integrated this new component in a EuiBasictable:
```
{
  id: 'ruleSnoozeNotify',
  name: (
    <EuiToolTip
      data-test-subj="rulesTableCell-notifyTooltip"
      content={i18n.COLUMN_NOTIFY_TOOLTIP}
    >
      <span>
        {i18n.COLUMN_NOTIFY}
        &nbsp;
        <EuiIcon size="s" color="subdued" type="questionInCircle" className="eui-alignTop" />
      </span>
    </EuiToolTip>
  ),
  width: '14%',
  'data-test-subj': 'rulesTableCell-rulesListNotify',
  render: (rule: Rule) => {
    return triggersActionsUi.getRulesListNotifyBadge({
      rule: {
        id: rule.id,
        muteAll: rule.mute_all ?? false,
        activeSnoozes: rule.active_snoozes,
        isSnoozedUntil: rule.is_snoozed_until ? new Date(rule.is_snoozed_until) : null,
        snoozeSchedule: rule?.snooze_schedule ?? [],
        isEditable: hasCRUDPermissions,
      },
      isLoading: loadingRuleIds.includes(rule.id) || isLoading,
      onRuleChanged: reFetchRules,
    });
  },
}
```

I think Security solution folks might want/need to create a new io-ts
schema for `snooze_schedule` something like that should work:
```ts
import { IsoDateString } from '@kbn/securitysolution-io-ts-types';
import * as t from 'io-ts';

const RRuleRecord = t.intersection([
  t.type({
    dtstart: IsoDateString,
    tzid: t.string,
  }),
  t.partial({
    freq: t.union([
      t.literal(0),
      t.literal(1),
      t.literal(2),
      t.literal(3),
      t.literal(4),
      t.literal(5),
      t.literal(6),
    ]),
    until: t.string,
    count: t.number,
    interval: t.number,
    wkst: t.union([
      t.literal('MO'),
      t.literal('TU'),
      t.literal('WE'),
      t.literal('TH'),
      t.literal('FR'),
      t.literal('SA'),
      t.literal('SU'),
    ]),
    byweekday: t.array(t.union([t.string, t.number])),
    bymonth: t.array(t.number),
    bysetpos: t.array(t.number),
    bymonthday: t.array(t.number),
    byyearday: t.array(t.number),
    byweekno: t.array(t.number),
    byhour: t.array(t.number),
    byminute: t.array(t.number),
    bysecond: t.array(t.number),
  }),
]);

export const RuleSnoozeSchedule = t.intersection([
  t.type({
    duration: t.number,
    rRule: RRuleRecord,
  }),
  t.partial({
    id: t.string,
    skipRecurrences: t.array(t.string),
  }),
]);
```


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2023-02-07 08:17:18 -05:00
Alexi Doak
cb7cc4a4c8
[ResponseOps][Flapping] Update flapping code once the flapping lookback value is configurable (#149448)
Resolves https://github.com/elastic/kibana/issues/145929

## Summary

Updates previous flapping tests to use the new flapping settings
configs.
Updates flapping logic to use flapping configs instead of hardcoded
values. Calls the flapping api on every rule execution, and then passes
in the flapping settings to the rule executors so they can be used by
the rule registry.


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### To verify

I think it's helpful to hide the whitespace when reviewing this pr.

- The flapping logic should remain the same, and all previous tests
should pass. I only updated them to pass in the flapping settings.
- Create rules, and set flapping settings in the ui and see the flapping
behavior change for your rules.
- Verify that the
`x-pack/test/alerting_api_integration/spaces_only/tests/alerting/event_log.ts`
run with the new flapping configs and output results we would expect

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2023-02-02 08:32:30 -05:00
Tiago Costa
e38350f7f9
chore(NA): upgrades uuid to v9.0.0 (#149135)
This PR upgrades uuid into its latest version `9.0.0`.
The previous default used version `v4` was kept where it was previously
used and places using `v1` or `v5` are still using it.

In this latest version they removed the deep import feature and as we
are not using tree shaking it increased our bundles by a significant
size. As such, I've moved this dependency into the `ui-shared-deps-npm`
bundle.

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-01-19 19:48:07 +00:00
Mike Côté
a1923c5f6a
Make rule executors return state as an object property (#147891)
In this PR, I'm changing the return type of rule executors from `return
state;` to `return { state };`.

This change had to touch all rule type executors so they return `state`
as a key. In the future, the framework could accept more than `state` in
the object, like warnings as an example.

**Before:**
```
executor: async (...) {
  const state = {...};
  return state;
}
```

**After:**
```
executor: async (...) {
  const state = {...};
  return { state };
}
```

**Future:**
```
executor: async (...) {
  return {
    state: {...},
    warnings: [...],
    metrics: {...},
    ...
  };
}
```

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-01-12 08:27:11 -07:00
Dmitry Tomashevich
503b466b72
[Discover][Alerting] Use Discover locator for alert results link (#146403)
## Summary

Closes #145815, #134232

- Moves Discover locator to common area
- Builds alerts results link from the server
- Now there are two implementations of `setStateToKbnUrl` which is used
in locator. New one in common are lost `HashedItemStore` support, since
sessions storage are actual only for browser
- Toasts `Alert rule has changed`, `Data View has changed` removed
- link generated per each alert will be unique representation of those
`rule params` and `data view state` which were at the time of invocation
- Restuls link will live even after data view and rule removal




### How to create rule

- Create an output index and data view `test` 
<details>
  <summary>Query to use</summary>
  
```
PUT test
{
    "settings" : {
        "number_of_shards" : 1
    },
    "mappings" : {
        "properties" : {
            "rule_id" : { "type" : "text" },
            "rule_name" : { "type" : "text" },
            "alert_id" : { "type" : "text" },
            "context_message": { "type" : "text" }
        }
    }
}
```
</details>

- Create alerts connector using `test` index
- Open `Elasticsearch query` alert in `KQL or Lucene` mode or just using
Discover `Alerts` button
- Specify the following params: `IS ABOVE: 1`, `FOR THE LAST: 30 min`
- Try execute it by clicking `Test query`. It should match some results
- When choosing connector, use the following config
```
{
    "rule_id": "{{rule.id}}",
    "rule_name": "{{rule.name}}",
    "alert_id": "{{alert.id}}",
    "context_message": "{{context.message}}"
}
```
- Create the alert

### How to test

- Create `Elasticsearch query` rule in `KQL or Lucene` mode like
described above
- Wait for some seconds and find the triggered alert document by
browsing `test` data view in Discover. There should be a link to results
in `context_message` field. Save the link somewhere
- Change rule params by adding/removing filters / changing query /
changing data view
- Follow saved link, you should see previous filters, query and data
view state
- Open rule in management and click `View in app`, you should see actual
state of rule
- Try to remove used data view and then follow saved link, you should
still see the results
- Try to remove rule and then follow saved link, you should still see
the results.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)

Co-authored-by: Davis McPhee <davis.mcphee@elastic.co>
2023-01-04 15:46:14 +03:00
Ying Mao
fdf4dea9bd
[Response Ops][Alerting] Adding group by options to ES query rule type (#144689)
Resolves https://github.com/elastic/kibana/issues/89481

## Summary

Adds group by options to the ES query rule type, both DSL and KQL
options. This is the same limited group by options that are offered in
the index threshold rule type so I used the same UI components and rule
parameter names. I moved some aggregation building code to `common` so
they could be reused. All existing ES query rules are migrated to be
`count over all` rules.

## To Verify

* Create the following types of rules and verify they work as expected.
Verify for both DSL query and KQL query
* `count over all` rule - this should run the same as before, where it
counts the number of documents that matches the query and applies the
threshold condition to that value. `{{context.hits}}` is all the
documents that match the query if the threshold condition is met.
* `<metric> over all` rule - this calculates the specific aggregation
metric and applies the threshold condition to the aggregated metric (for
example, `avg event.duration`). `{{context.hits}}` is all the documents
that match the query if the threshold condition is met.
* `count over top N terms` - this will apply a term aggregation to the
query and matches the threshold condition to each term bucket (for
example, `count over top 10 event.action` will apply the threshold
condition to the count of documents within each `event.action` bucket).
`{{context.hits}}` is the result of the top hits aggregation within each
term bucket if the threshold condition is met for that bucket.
* `<metric> over top N terms` - this will apply a term aggregation and a
metric sub-aggregation to the query and matches the threshold condition
to the metric value within each term bucket (for example, `avg
event.duration over top 10 event.action` will apply the threshold
condition to the average value of `event.duration` within each
`event.action` bucket). `{{context.hits}}` is the result of the top hits
aggregation within each term bucket if the threshold condition is met
for that bucket.
* Verify the migration by creating a DSL and KQL query in an older
version of Kibana and then upgrading to this PR. The rules should still
continue running successfully.


### Checklist

- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Lisa Cawley <lcawley@elastic.co>
2022-12-15 11:03:58 -05:00
Dmitry Tomashevich
6b5ab8f334
[Discover] Validate if Data View time field exists on Alert creation / editing (#146324)
## Summary

Closes #135806

This PR adds optional `timeField` param for Discover alert and adding
validation data view if it time based.


![AD61D10F-6278-429C-B69D-C1952BB0A3C1_4_5005_c](https://user-images.githubusercontent.com/39378793/205312590-0392cd2e-740e-4e3e-ba17-712e0696eef3.jpeg)

### How to test
- Open `Alerts` in Discover
- Select non time based data view
- Try to save the rule. You should see error message.


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-12-14 16:17:50 +03:00
Dmitry Tomashevich
a9162f7481
[Discover] Enable esQuery alert for adhoc data views (#140885)
## Summary

Closes #142514 #142389

This PR does the following: 
- Enables to create `esQuery` (in KQL or Lucene mode) using adhoc data
views from discover and management pages
- Adds `explore matching indices` button to data view picker in alert
flyout
- Adding adhoc data views from alert flyout should propage them to a
main discover picker


### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [x] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [x] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))

Co-authored-by: Davis McPhee <davis.mcphee@elastic.co>
2022-11-09 18:55:34 +03:00
Ying Mao
a62635146e
[Response Ops][Alerting] alert -> rule for stack alerts (#144613)
* Renaming folder

* Renaming alertType to ruleType. Adding parameters to support group by

* Renaming

* Updating codeowners
2022-11-04 14:44:41 -04:00
Ying Mao
3b59a90671
[Response Ops][Alerting] Removing top level rule fields passed into executors (#144270)
* Removing top level fields passed into executors

* Updating stack rules

* Updating other rules

* Fixing types

* Fixing functional test

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-11-04 09:20:54 -04:00
doakalexi
b00f3b0ab9
[ResponseOps][Alerting] create new logger with tag for rule/connector type, for logger given to executors (#142121)
* Updating connector logger

* Updating rule logger

* Fixing type failure

* Fixing failing tests

* Fixing other type failure

* Fixing types

* Fixing more types

* Making logger optional

* Removing change

* Fixing errors

* Fixing preview routes

* Fixing tests and types

* Updating substrings

* Use logger in runRule function

* Fixing task runner tests

* Updating logger in constructor

* Linting fix

* Fixing action logger
2022-10-17 15:33:06 -04:00
Ersin Erdal
660a24e94f
Add filter field to index threshold rule type (#142255)
* Add filter field to index threshold rule type
2022-10-14 00:17:30 +02:00
Ying Mao
a231f9c4fd
[Response Ops][Alerting] Update stack rules to respect max alert limit (#141000)
* wip

* wip

* Adding bucket selector clauses

* Adding comparator script generator

* Generating all the right queries

* Skip condition check if group agg

* Fixing functional test

* Fixing comparator script

* Fixing tests

* Fixing tests

* Renaming

* Using limit services in es query rule executor

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-10-06 10:21:09 -04:00
Ying Mao
4f649c09c5
[Response Ops] Allow _source field for ES DSL query rules (#142223)
* Allowing _source in ES query DSL

* Adding functional test

* Adding to doc

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-10-05 19:18:59 -04:00
Pierre Gayvallet
9579ea7235
Move src/core/types/elasticsearch to @kbn/es-types (#140522)
* create empty package

* move types to packages

* [CI] Auto-commit changed files from 'node scripts/generate codeowners'

* start fixing imports

* fix more imports

* fix inline import

* add apm-ui as owners

* [CI] Auto-commit changed files from 'node scripts/generate codeowners'

* fix new usages

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2022-09-20 10:32:13 +02:00
Ying Mao
27315aceba
[Response Ops] Add framework services for rule types to respect alert circuit breaker (#139501)
* Adding service functions to alert factory

* Fixing types

* Fixing types

* Small refactor

* Adding functional test

* Cleanup

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-09-06 10:21:28 -04:00
Ersin Erdal
7d3f762186
Add "exclude previous hits" check box to ESQuery rule form (#138781)
* Add "Exclude the hits from previous rule run" check box to ESQuery rule form
2022-09-05 13:09:09 +02:00
Gidi Meir Morris
502dc0a4d0
[E&C][ES Query] adds runtime mappings and fields support to the ES Query ruletype (#138427)
This PR adds Runtime Fields support to the ES Query Rule Type when using the DSL Query mode.
2022-08-22 13:17:46 +01:00
Ying Mao
db72db9e7c
[Response Ops] [Alerting] Adds circuit breaker that limits the max number of alerts that can be reported each rule run. (#138446)
* Adding config for max alerts. Throw error in alert factory when max alerts are reported. Process alerts differently when alert limit is reached

* Fixing types. Adding new config to docker and docs

* Setting flag to indicate limit reached. Update rule status to warning if limit reached

* Fixing task runner test

* Cleanup

* Fixing task runner test

* Actually using result of hasReachedAlertLimit

* Fixing types

* Copying over scheduled actions for active alerts. Only execute actions if they exist

* Setting lower limit in functional test config

* Adding functional test

* Update x-pack/plugins/alerting/server/constants/translations.ts

Co-authored-by: Lisa Cawley <lcawley@elastic.co>

* PR feedback

Co-authored-by: Lisa Cawley <lcawley@elastic.co>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-08-16 07:36:38 -07:00
Nathan Reese
91f15ff355
[maps] add context for 'No longer contained' geo-containment alert (#136451)
* [maps] add context for 'No longer contained' geo-containement alert

* populate recovered alert context

* do not include context.containingBoundaryId and context.containingBoundaryName for recovered alert context

* [CI] Auto-commit changed files from 'node scripts/precommit_hook.js --ref HEAD~1..HEAD --fix'

* do not set containement in recovered context

* add comments

* clean up

* comment typo

* review feedback rename containtments => containments

* update context variable descriptions

* get_context unit tests

* update jest snapshot

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-07-21 14:59:09 -06:00
Pierre Gayvallet
3508350446
Migrate server-side ES domain to packages (#136297)
* create es types package

* start moving client types to @kbn/core-elasticsearch-server

* move ElasticsearchClientConfig to package

* start adapting usages

* start fixing imports

* fix more imports

* just a bit more

* move service types

* [CI] Auto-commit changed files from 'node scripts/precommit_hook.js --ref HEAD~1..HEAD --fix'

* fix more internal types

* move retry call cluster helpers outside of client package

* move client code and mocks to packages

* fix imports

* adapt external usages

* adapt more external usages

* adapt more external usages 2

* fix mocked module

* create empty domain packages

* more external usages fix

* move ALL the things (again)

* mock external import fix

* fix tests, add test dependencies

* fix some internal usages

* fix more internal usages

* [CI] Auto-commit changed files from 'node scripts/precommit_hook.js --ref HEAD~1..HEAD --fix'

* fix cli_setup usage

* desperate times force desperate decisions

* fix misc stuff

* update snapshots (?!)

* fix mocked package

* self review

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2022-07-20 10:07:48 +02:00
Ying Mao
a5a287b383
[Response Ops] Adds recovery context for ES query rule type (#132839)
* Renaming alert to rule for es query rule type

* adding recovery context

* Updating unit tests

* Fixing i18n

* Adding functional test

* Adding functional test

* Fixing functional test

* Adding space id to link

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-06-04 06:57:47 -07:00
Dmitry Tomashevich
bc31053dc9
[Discover][Alerting] Implement editing of dataView, query & filters (#131688)
* [Discover] introduce params editing using unified search

* [Discover] fix unit tests

* [Discover] fix functional tests

* [Discover] fix unit tests

* [Discover] return test subject name

* [Discover] fix alert functional test

* Update x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression_form.tsx

Co-authored-by: Julia Rechkunova <julia.rechkunova@gmail.com>

* Update x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression_form.tsx

Co-authored-by: Matthias Wilhelm <ankertal@gmail.com>

* [Discover] hide filter panel options

* [Discover] improve functional test

* [Discover] apply suggestions

* [Discover] change data view selector

* [Discover] fix tests

* [Discover] apply suggestions, fix lang mode toggler

* [Discover] mote interface to types file, clean up diff

* [Discover] fix saved query issue

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.ts

Co-authored-by: Matthias Wilhelm <ankertal@gmail.com>

* [Discover] remove zIndex

* [Discover] omit null searchType from esQuery completely, add isEsQueryAlert check for useSavedObjectReferences hook

* [Discover] set searchType to esQuery when needed

* [Discover] fix unit tests

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type_params.ts

Co-authored-by: Matthias Wilhelm <ankertal@gmail.com>

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type.ts

Co-authored-by: Matthias Wilhelm <ankertal@gmail.com>

Co-authored-by: Julia Rechkunova <julia.rechkunova@gmail.com>
Co-authored-by: Matthias Wilhelm <ankertal@gmail.com>
2022-05-20 17:09:20 +03:00
Dmitry Tomashevich
fdf2086eb0
[Discover] Cancel long running requests in Discover alert (#130077)
* [Discover] improve long running requests for search source within alert rule

* [Discover] add tests

* [Discover] fix linting

* [Discover] fix unit test

* [Discover] add getMetrics test

* [Discover] fix unit test

* [Discover] merge search clients metrics

* [Discover] wrap searchSourceClient

* [Discover] add unit tests

* [Discover] replace searchSourceUtils with searchSourceClient in tests

* [Discover] apply suggestions
2022-05-19 10:24:55 +03:00
spalger
3730dd0779 fix all violations 2022-04-16 01:37:30 -05:00
Dmitry Tomashevich
3522a7fdc7
[Alerting] Improve comparator types of es_query && index_threshold rules (#129190)
* [Alerting] improve comparator types

* [Discover] fix unit tests

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-04-07 14:59:31 +05:00
Ying Mao
25d9f5d97e
[Response Ops] Renaming Alert to Rule (#129136)
* Rename all the things

* Fixing checks

* Removing unnecessary change

* Fixing checks
2022-04-04 07:32:32 -04:00
Dmitry Tomashevich
0427952e76
[Discover] Extend Elasticsearch query rule with search source based data fetching (#124534)
* [Discover] introduce .index-threshold rule

* [Discover] change filters in alert expression

* [Discover] fix cursor issue

* [Discover] add loading

* [Discover] separate validation params

* [Discover] add view alert route

* [Discover] enable "view in app" for alert created from discover

* [Discover] fix filter popover

* [Discover] fix linting, unit tests

* [Discover] fix remaining tests

* [Discover] add unit tests, add link back to stack management for es query

* Update src/plugins/discover/public/application/view_alert/view_alert_route.tsx

* [Discover] add tool tip for data view without time field

* [Discover] add info alert about possible document difference that triggered alert and displayed documents

* [Discover] update unit test

* [Discover] fix unit tests

* Update x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update src/plugins/discover/public/application/main/components/top_nav/open_alerts_popover.tsx

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* [Discover] fix unit tests

* [Discover] fix security solution alerts

* [Discover] fix eslint errors

* [Discover] fix unit tests

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* [Discover] apply suggestions

* [Discover] fix tests

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

* [Discover] remove close button in filters

* Improve code structure

* Fix missing name in fetchEsQuery

* Fix messages

* Fix messages, again

* Refactor

* Refactor, add tests + a bit more of documentation

* Move size field, change text

* Implement readonly callout

* change icon in callout

* add padding to popover

* Hide query and filter UI if there are no values to display

* [Discover] add unit test, improve comparator types

* [Discover] fix linting and unit test

* [Discover] add es query alert integration tests

* [Discover] fix linting

* [Discover] uncomment one expect

* [Discover] fix latesTimestamp for searchSource type, unify test logic

* Update x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* [Discover] apply suggestions

* [Discover] make searchType optional, adjust tests

* [Discover] remove updated translations

* [Discover] apply suggestions

* [Discover] fix unit test

* [Discover] close popover on alert rule creation

* [Discover] apply suggestions

* [Discover] add first functional test

* [Discover] implement tests

* Move functionals x-pack since ssl is needed

* Fix potential flakiness in functional test

* [Discover] remove timeout waiter

* Fix functional test

- adding permissions to fix the functional

* [Discover] add logger

* [Discover] add more log points

* [Discover] wait for indices creation finished

* Try to fix the functional flakiness
- by creating data views in a serial way
- lets see if that work

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>
Co-authored-by: Matthias Wilhelm <matthias.wilhelm@elastic.co>
Co-authored-by: andreadelrio <andrea.delrio@elastic.co>
2022-04-01 14:57:57 +05:00
Mike Côté
6456d184c0
Cancel search queries on timeout regardless of rule type (#124374)
* Initial commit

* Add unit test

* Change code for wrapping

* Fix failing tests

* Fix creation of wrappedClient

* Fix merge issues

* Remove TContext

* Attempt at fixing meta stuff

* Use esClient.child

* Fix wrap scoped cluster client tests

* Fix task cancel jest tests

* Fix wrapEsClient to mutate the wrappedClient within the function

* Update with main

* Fix jest test failures

* Add missing jest test from create_abortable_es_client_factory.test.ts

* Fix merge

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-03-09 14:52:52 -05:00
Ying Mao
b395e53da9
[Alerting] Provide services to set context for recovered alerts (#124972)
* Rename alert instance to alert and add create fn to alert factory

* Rename alert instance to alert and add create fn to alert factory

* Fixing types

* Fixing types

* Adding flag for rule types to opt into setting recovery context

* Only showing context in action variable menu if flag set to true

* Adding recovery functions to createAlertFactory

* Setting recovery in index threshold and fixing types

* Fixing lint issues and some refactoring

* Cleanup

* Functional tests for index threshold rule recovery context

* Return array of recovered alerts instead of record

* Fixing types

* Fixing types

* Cleanup

* Handling nulls and more tests

* Updating developer docs

* Making getRecoveryAlerts non-optional

* Setting unknown in index threshold recovery value

* PR feedback

* Adding a test

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-02-21 09:52:14 -07:00
Pierre Gayvallet
6627bd8b3a
Elasticsearch client: no longer default to using meta: true (#124488)
* Use `Client` interface instead of `KibanaClient`

* get rid of getKibanaEsClient and convertToKibanaClient

* get rid of last KibanaClient usages

* update usages and types in @kbn/securitysolution-es-utils

* fix some violations

* add sugar method around client mock

* update SO repository calls

* adapt more core usages

* export mock types

* batch 1

* batch 2

* batch 3

* batch 4

* batch 5

* batch 6

* batch 7

* batch 8

* batch 9

* security - batch 1

* security - batch 2

* security - batch 3

* last batch of initial violations

* fix resolve_time_pattern

* update generated doc

* fix /internal/index-pattern-management/preview_scripted_field endpoint

* fix monitoring's getLegacyClusterShim

* fix /api/snapshot_restore/privileges route

* fix UptimeESClient

* fix transforms/_nodes endpoint

* lint

* unit test fix - batch 1

* unit test fix - batch 2

* unit test fix - batch 3

* integration test fix - batch 1

* lint

* adapt ML client

* unit test fix - batch 4

* fix uptime test helper

* fix /api/transform/transforms/{transformId}/_update route

* fix ES client FTR test

* fix uptime unit test

* fix type errors on last unit tests

* fix RollupSearchStrategy call

* fix /internal/security/fields/{query} route

* fix GET /api/index_lifecycle_management/policies route

* fix mlClient.getDataFrameAnalytics

* fix APMEventClient

* fix security solution getBootstrapIndexExists

* fix data_enhanced's getSearchStatus

* remove unused @ts-expect-error

* fix unit tests due to latest code changes

* fix more calls in security_solution routes

* fix more calls in ml routes

* fix POST /api/index_management/component_templates route

* fix unit tests due to latest changes

* fix rule_registry's ResourceInstaller.createOrUpdateIndexTemplate

* fix more fleet client calls

* fix UA's GET cloud_backup_status route

* fix createLifecycleExecutorApiTest

* fix hasFleetServers

* fix unit tests due to latest changes

* changes due to last merge

* fix ml modelProvider.getModelsPipelines

* fix security_solution LifecycleQuery.search

* fix new CoreUsageDataService usage

* fix security solution's StatsQuery.search

* improve ml FTR assertions

* fix security_solution's EventsQuery.search

* fix EsClient type as we're keeping transport

* NITs

* clean RepositoryEsClient type

* update generated doc

* review comments

* adapt mlClient.anomalySearch signature

* remove unnecessary .then((body) => body)

* nit

* add unit tests for the client mocking functions

* fix new upgrade assistant /remote_clusters endpoint
2022-02-12 09:19:44 +01:00
Ying Mao
270adf4958
[Alerting] Rename alert instance to alert and changing signature of alert (instance) factory alert creation (#124390)
* Rename alert instance to alert and add create fn to alert factory

* Rename alert instance to alert and add create fn to alert factory

* Fixing types

* Fixing types

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-02-07 14:38:24 -07:00
Garrett Spong
48693d1fd6
[RAC][Alerting][Security Solution] Adds Rule Execution UUID (#113058)
## Summary

Resolves: https://github.com/elastic/kibana/issues/110135

This PR is for introducing a new UUID (`kibana.alert.rule.execution.uuid` as defined in the AAD schema) for identifying individual rule executions. This id is introduced as a `private readonly` member of the [alerting server task_manager](a993668663/x-pack/plugins/alerting/server/task_runner/task_runner.ts (L123)), and plumbed through the `executionHandler` and to all appropriate alert event and event-log touch points.

For persistence when writing alerts within the RuleRegistry, `kibana.alert.rule.execution.uuid` is plumbed through [`getCommonAlertFields()`](c81341c325/x-pack/plugins/rule_registry/server/utils/get_common_alert_fields.ts (L52)) so it is grouped with like fields and is picked up by both the [`createPersistenceRuleTypeWrapper`](c81341c325/x-pack/plugins/rule_registry/server/utils/create_persistence_rule_type_wrapper.ts (L38)) used by Security Solution, and [`createLifecycleExecutor`](d152ca5b6b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts (L157)) used by Observability rules.

Additionally on the Security Solution side, `kibana.alert.rule.execution.uuid` was plumbed through the `RuleExecutionLog` so that all events written to the event-log will now include this id so individual rule status events/metrics can be correlated with specific rule executions.

No UI facing changes were made, however `kibana.alert.rule.execution.uuid` is now available within the Alerts Table FieldBrowser, and can be toggled and viewed alongside alerts:

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/149594433-b16e369b-adf4-4ae3-b6e9-98189b214d51.png" />
</p>

As visible when exploring `event-log` in Discover:

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/149595237-155d25d7-8324-4981-9ec2-faf0af8e7bd7.png" />
</p>



### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials 
  - Will need to sync with Doc folks on updates here.
- [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2022-01-20 18:47:36 -07:00
ymao1
1703e03163
[Alerting] Using abortable es client in stack rules (#122435)
* Using abortable es client in index threshold rule

* Using abortable es client in es query rule

* Fixing unit tests

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-01-11 15:49:24 -05:00
Mikhail Shustov
38feafad72
Update ES client to canary.37 (#119791)
* upgrade es client to canary 37

* fix error in core

* mute error in test/

* mute incompatible errors

* unskip request_entity_too_large_exception test

* commit autofix

* unskip batch_size_bytes_exceeds_es_content_length test

* fix errors in Core code

* fix or mute errors in data plugin

* fix data_view_management

* fix error index_management

* fix x-pack/test errors

* fix watcher

* fix event_log

* fix data_enhanced

* fix uptime

* fix triggers_actions_ui

* fix transform

* fix reporting

* fix rule_registry

* fix timeline

* fix task_manager

* fix security_solution

* fix rule_registry

* fix fleet

* fix index_management

* fix lens

* fix maps

* fix ml

* fix observability

* bump to canary 8.1-2

* fix error in packages

* fix errors in core

* fix errors in data

* fix errors in discover

* fix some discover tests

* fix errors in telemetry

* fix alerting

* fix errors in apm

* fix errors in event_log

* fix errors in fleet

* fix errors in infra

* fix errors in lists

* mute errors in maps

* fix errors in ml

* fix errors in osquery

* fix errors in security_solution

* fix errors in stack_alerts

* fix errors in task_manager

* fix errors in timelines

* fix errors in transform

* fix errors in watcher

* fix errors in tests

* update docs

* adjust fleet code

* fix problem in fleet

* remove outdated _type from data plugin tests

* fix packages tests

* update type

* fix tests part 2

* Adds product header back to elasticsearch

* Updates API docs

* Fix Discover tests

* update alerting typings

* Fix type errors

* Import Sort type

* Update x-pack/plugins/security_solution/common/endpoint/data_loaders/index_fleet_server.ts

Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co>

* Remove double negation

* Fix snapshot conflict issues after merge from "main"

Co-authored-by: Christiane Heiligers <christiane.heiligers@elastic.co>
Co-authored-by: Matthias Wilhelm <matthias.wilhelm@elastic.co>
Co-authored-by: Dario Gieselaar <dario.gieselaar@elastic.co>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Alejandro Fernández Haro <afharo@gmail.com>
Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co>
Co-authored-by: Alejandro Fernández Haro <alejandro.haro@elastic.co>
2021-12-24 14:43:53 +01:00
Matthew Kime
d4fdd35543
[dataViews] no more IndexPatternBase, IndexPatternFieldBase (#121836)
* remove IndexPatternFieldBase and IndexPatternBase references
2021-12-22 08:46:21 -06:00
ymao1
7c27163d6a
[Alerting] Renaming AlertType to RuleType and updating Alerting Task Runner (#120661)
* Renaming AlertType to RuleType and updating Alerting Task Runner

* Fixing types

* Fixing types

* holy cannoli

* Fixing types

* Fixing types and tests

* Fixing types and tests

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2021-12-09 09:21:38 -05:00
Spencer
4385ac4d83
[eslint] enable type-specific lint rules (#114184)
* [eslint] enable type-specific lint rules

* autofix violations

* duplicate eslint-disable to new export statement

Co-authored-by: spalger <spalger@users.noreply.github.com>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2021-11-03 16:56:17 -06:00
Mikhail Shustov
3c8fa527a7
[ES] Upgrade client to v8.0 (#113950)
* bump to a pre-8.0 version

* export KibanaClient from /lib sub-folder

* workaround the problem of the absence of estypes

* update es client usage in pacakges

* export estypes from another path

* import errors from root

* import errors from root 2

* update transport import

* update import path for /api/types

* update import path for /api/types

* import errors from top export

* use TransportResult instead if ApiResponse

* fix errors in client_config

* fix src/core/server/saved_objects/migrationsv2/actions/integration_tests/actions.test.ts

* use KibanaClient in mock. we dont export the original Client

* fix client mocks

* fix errors on SO

* fix remaining core errors

* update estype import path

* fix errors in data plugin

* fix data_views

* fix es_ui_shared

* fix errors in interactive_setup

* fix errors in ./test folder

* add @elastic/transport to the runtime deps

* fix errors in packages

* fix erros in src/core

* fix errors in test/

* fix an error in actions plugin

* woraround and fix errors in APM plugin

* fix errors in canvas

* fix errors in event_log

* fix errors in fleet

* fix errors in ILM

* fix errors in infra

* fix errors in ingest_pipeline

* fix errors in lens

* fix errors in license_management

* fix errors in licensing

* fix errors in logstash

* fix errors in ml

* fix errors in monitoring

* fix errors in observability

* fix errors in rule_registry

* fix errors in reporting

* fix errors in rule_registry

* fix errors in security

* fix errors in security_solution

* fix errors in snapshot_restore

* fix errors in transform

* fix errors in UA

* fix errors in uptime

* fix errors in x-pack/test

* fix eslint errors

* fix new errors

* use default HTTP Connection. Undici does not support agent config options keepAlive and maxSockets

* create does not accept require_alias option

* update deps

* use transport types exported from ES client package

* fix ErrorCause | string errors

* do not use enum

* fix errors in data plugin

* update x-pack code

* fix transport

* fix apm search request

* do not crash on reporting

* fix kbn-test build

* mute reporting error to start

* fix ftr build

* another attempt

* update import path

* address or mute new errors

* REMOVE me. pin transport version temporarily.

* remove deep imports from transport package

* fix jest crash

* fix product check tests

* remove unnecessary ts-expect-error

* fix a few failed unit tests

* bump to canary 24

* remove unnecessary ts-expect-error

* remove dependency on transport

* fix types in tests

* mute errors in xpack tests

* product check doesn;t  spam in logs anymore

* filterPath --> filter_path

* ignoreUnavailable --> ignore_unavailable

* ignoreUnavailable --> ignore_unavailable

* trackScores --> track_scores

* trackTotalHits --> track_total_hits

* fix es-arcives

* fix data plugin crashes

* fix watcher test utils

* rollback unnecessary changes

* fix another problem in es-archiver

* fix scroll. for whatever reason scroll fails when request scroll_id in body

* add meta: true in kbn-securitysolution-es-utils

* bump client to canary 25

* fix errors in accordance with the es client spec

* update securityscolution-es-utils

* unify scroll api in reporting and fix tests

* fix unit tests in watcher

* refactor APM to abort request with AbortController API

* fix missing es client calls in tests

* fix missing meta in detection engine FTR tests

* fix another bunch of errors in js tests

* fix wrong coercion

* remove test-grep pattern

* fix apm unit test

* rename terminateAfter to terminate_after in infra plugin

* rename terminateAfter to terminate_after in uptime plugin

* rename terminateAfter to terminate_after in apm plugin

* fix security roles FTR tests

* fix reference

* fix post_privilidges test

* fix post_privilidges

* bump client to 26

* add meta for index_management test helpers

* remove ts-expect-error caused by bad type in reason

* bump client to 27

* REMOVE me. workaround until fixed in the es client

* fix incorrect type casting

* swtich from camelCase params

* use `HttpConnection` for FTR-related clients

* bump client to 29

* Revert "REMOVE me. workaround until fixed in the es client"

This reverts commit c038850c09.

* fix new util

* revert repository changes

* do not crash if cannot store event_loop data

* fix new estypes imports

* fix more types

* fix security test types and add ts-ignore for custom ES client

* fix more estypes imports

* yet more ts violations

* line by line fixing is hard

* adapt `evaluateAlert` from infra as it's also used from FTR tests

* use convertToKibanaClient in FTR test instead of meta:true in plugin code

* migrate from deprecated API in fleet

* fix intergration tests

* fix fleet tests

* fix another fleet test

* fix more tests

* let's call it a day

* Removes custom header check on 404 responses, includes es client ProductNotSupportedError in EsUnavailableError conditional (#116029)

* Removes custom header check on 404 responses, includes es client ProductNotSupportedError in EsUnavailableError conditional

* Updates proxy response integration test

* disable APM until compatible with client v8

* skip async_search FTR test

* use kbnClient in integration tests

* bump version to 29

* bump to 30

* have configureClient return a KibanaClient instead of Client, remove resolved violations.

* bump to 31

* bump to 31

* Revert "bump to 31"

This reverts commit 5ac713e640.

* trigger stop to unusubscribe

* update generated docs

* remove obsolete test

* put "as" back

* cleanup

* skip test

* remove new type errors in apm package

* remove ErrorCause casting

* update a comment

* bump version to 32

* remove unnecessary ts-expect-error in apm code

* update comments

* update to client v33

* remove outdated type definition

* bump to 34 without params mutation

* unskip the test that should not fail anymore

* remove unnecessary ts-expect-error comments

* update to v35. body can be string

* move `sort` to body and use body friendly syntax

* fix a failing test. maps register the same SO that has been already registered by home

Co-authored-by: pgayvallet <pierre.gayvallet@gmail.com>
Co-authored-by: Christiane (Tina) Heiligers <christiane.heiligers@elastic.co>
2021-10-26 14:08:22 +02:00
Chris Roberson
ce546998a4
Add deprecation levels (#115832) 2021-10-21 15:44:06 -04:00
Mike Côté
cc3f601bd5
Initial commit (#115846) 2021-10-21 09:56:25 -04:00