mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 09:48:58 -04:00
ab43a50045
## Summary Resolves https://github.com/elastic/kibana/issues/146348 - Adds new context variables for count and ratio alerts in Log threshold rule - Indexes new context variables to AAD - Adds new context variables to recovered count and ratio alerts The context variables are added based on group by and filter used when creating the rule. When the prefix of `group by` or filter (`WITH` condition) includes one of the following, contextual attributes for that entity are added. - `cloud` - `host` - `orchestrator` - `container` - `labels` - `tags` Following fields are excluded from the context: `*.cpu`, `*.network`, `*.disk`, `*.memory` In case of ratio alerts without `group by`, the prefix from numerator query is considered to add contextual attributes. In both count and ratio alerts, only positive criteria is used from filter (with `is` or `matches` condition) for adding contextual attributes. ### Manual Testing 1. Create different Log threshold rules (Count, Ratio, With group by, Without group by) 2. Configure action template with `{{context}}` 3. Observe additional context to be included in alert notification 4. Let alerts be recovered 5. Observe additional context to be included in recovery notification 6. Observe additional context fields are indexed in AAD ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| calculate_metric_interval.ts | ||
| create_afterkey_handler.ts | ||
| elasticsearch_runtime_types.ts | ||
| get_all_composite_data.ts | ||
| get_all_metrics_data.ts | ||
| get_original_action_group.ts | ||
| README.md | ||
| request_context.ts | ||
| round_timestamp.ts | ||
| serialized_query.ts | ||
| typed_elasticsearch_mappings.ts | ||
| typed_search_strategy.ts | ||
Utils should be data processing functions and other tools.... all in all utils is basicly everything that is not an adaptor, or presenter and yet too much to put in a lib.