Your window into the Elastic Stack
Find a file
Sergi Massaneda 64426b2b4d
[Security Solution][Siem migrations] Implement rate limit backoff (#211469)
## Summary

Implements an exponential backoff retry strategy when the LLM API throws
rate limit (`429`) errors.

### Backoff implementation

- The `run` method from the `RuleMigrationsTaskClient` has been moved to
the new `RuleMigrationTaskRunner` class.
- The settings for the backoff are defined in this class with:
```ts
/** Exponential backoff configuration to handle rate limit errors */
const RETRY_CONFIG = {
  initialRetryDelaySeconds: 1,
  backoffMultiplier: 2,
  maxRetries: 8,
  // max waiting time 4m15s (1*2^8 = 256s)
} as const;
```
- Only one rule will be retried at a time, the rest of the concurrent
rule translations blocked by the rate limit will await for the API to
recover before attempting the translation again.

```ts
/** Executor sleep configuration
 * A sleep time applied at the beginning of each single rule translation in the execution pool,
 * The objective of this sleep is to spread the load of concurrent translations, and prevent hitting the rate limit repeatedly.
 * The sleep time applied is a random number between [0-value]. Every time we hit rate limit the value is increased by the multiplier, up to the limit.
 */
const EXECUTOR_SLEEP = {
  initialValueSeconds: 3,
  multiplier: 2,
  limitSeconds: 96, // 1m36s (5 increases)
} as const;
```

### Migration batching changes

```ts
/** Number of concurrent rule translations in the pool */
const TASK_CONCURRENCY = 10 as const;
/** Number of rules loaded in memory to be translated in the pool */
const TASK_BATCH_SIZE = 100 as const;
```

#### Before 

- Batches of 15 rules were retrieved and executed in a `Promise.all`,
requiring all of them to be completed before proceeding to the next
batch.
- A "batch sleep" of 10s was executed at the end of each iteration.

#### In this PR

- Batches of 100 rules are retrieved and kept in memory. The execution
is performed in a task pool with a concurrency of 10 rules. This ensures
there are always 10 rules executing at a time.
- The "batch sleep" has been removed in favour of an "execution sleep"
of rand[1-3]s at the start of each single rule migration. This
individual sleep serves two goals:
  - Spread the load when the migration is first launched.
- Prevent hitting the rate limit consistently: The sleep duration is
increased every time we hit a rate limit.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-02-21 19:54:40 +00:00
.buildkite [Security Solution] Extend rule upgrade integration tests for prebuilt rule customization feature (#209260) 2025-02-21 12:11:44 +01:00
.devcontainer Removing experimental for the FIPS mode config (#200734) 2024-11-19 15:23:20 -05:00
.github 🌊 Move streams to platform (#211893) 2025-02-21 16:34:50 +01:00
api_docs [api-docs] 2025-02-21 Daily api_docs build (#212003) 2025-02-21 08:24:26 +01:00
config [Fix] Inference preconfigured connector for EIS missing key (#210953) 2025-02-20 13:12:55 +02:00
dev_docs Revert "[ResponseOps] Document creating task-manager serverless monitoring assets - adding to kibana dev docs navigation" (#211030) 2025-02-13 18:09:06 +01:00
docs SKA: Fix kebab-case issues in observability-ui packages (#211248) 2025-02-14 19:34:14 +01:00
examples [Discover][Tabs] New tabs package and initial implementation of components (#210674) 2025-02-21 14:00:40 +01:00
kbn_pm Sustainable Kibana Architecture: Move CodeEditor related packages #205587 (#205738) 2025-01-08 15:25:47 +01:00
legacy_rfcs remove timeslider RFC (#211305) 2025-02-14 11:39:48 -07:00
licenses Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
oas_docs [Fleet] Expose ssl options for ES and remote ES outputs in UI (#208745) 2025-02-21 17:13:30 +00:00
packages [Synthetics] Fix overview error popover !! (#211431) 2025-02-21 16:38:54 +00:00
plugins
scripts SKA: Update broken references and URLs (#206836) 2025-01-28 03:32:48 +00:00
src Update docker.elastic.co/wolfi/chainguard-base:latest Docker digest to 0801a43 (main) (#212046) 2025-02-21 12:04:44 -06:00
test [Discover] [Embeddable] Fix Discover session embeddable drilldown (#211678) 2025-02-21 13:26:22 -04:00
typings make emotion typing global (#200958) 2024-12-05 12:20:43 -06:00
x-pack [Security Solution][Siem migrations] Implement rate limit backoff (#211469) 2025-02-21 19:54:40 +00:00
.backportrc.json chore(NA): adds 9.0 into backportrc (#208999) 2025-01-31 06:04:50 +00:00
.bazelignore Remove references to deleted .ci folder (#177168) 2024-02-20 19:54:21 +01:00
.bazeliskversion
.bazelrc chore(NA): use new and more performant BuildBuddy servers (#130350) 2022-04-18 02:01:38 +01:00
.bazelrc.common Transpile packages on demand, validate all TS projects (#146212) 2022-12-22 19:00:29 -06:00
.bazelversion chore(NA): revert bazel upgrade for v5.2.0 (#135096) 2022-06-24 03:57:21 +01:00
.browserslistrc Add Firefox ESR to browserlistrc (#184462) 2024-05-29 17:53:18 -05:00
.editorconfig
.eslintignore SKA: Fix outdated eslint rules (#206961) 2025-01-28 08:49:39 +01:00
.eslintrc.js [scout] enable eslint plugin playwright (#210666) 2025-02-14 10:21:49 +01:00
.gitattributes
.gitignore [Investigate App] add MVP evaluation framework for AI root cause analysis integration (#204634) 2025-01-17 12:16:10 -05:00
.i18nrc.json [Discover][Tabs] New tabs package and initial implementation of components (#210674) 2025-02-21 14:00:40 +01:00
.node-version Upgrade Node.js to 20.18.2 (#207431) 2025-01-22 12:00:14 -06:00
.npmrc [npmrc] Fix puppeteer_skip_download configuration (#177673) 2024-02-22 18:59:01 -07:00
.nvmrc Upgrade Node.js to 20.18.2 (#207431) 2025-01-22 12:00:14 -06:00
.prettierignore
.prettierrc
.puppeteerrc Add .puppeteerrc (#179847) 2024-04-03 09:14:39 -05:00
.stylelintignore
.stylelintrc Bump stylelint to ^14 (#136693) 2022-07-20 10:11:00 -05:00
.telemetryrc.json Sustainable Kibana Architecture: Move modules owned by @elastic/kibana-core (#201653) 2025-01-04 11:47:24 -07:00
.yarnrc
BUILD.bazel Transpile packages on demand, validate all TS projects (#146212) 2022-12-22 19:00:29 -06:00
catalog-info.yaml Configures PagerDuty Backstage Integration for kbn (#208440) 2025-01-27 23:29:11 +00:00
CODE_OF_CONDUCT.md
CONTRIBUTING.md
FAQ.md Fix small typos in the root md files (#134609) 2022-06-23 09:36:11 -05:00
fleet_packages.json [main] Sync bundled packages with Package Storage (#211800) 2025-02-20 12:08:24 +01:00
github_checks_reporter.json
kibana.d.ts Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
LICENSE.txt Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
NOTICE.txt [api-docs] 2025-01-01 Daily api_docs build (#205342) 2025-01-01 01:37:13 -06:00
package.json 🌊 Move streams to platform (#211893) 2025-02-21 16:34:50 +01:00
preinstall_check.js Adds AGPL 3.0 license (#192025) 2024-09-06 19:02:41 -06:00
README.md
renovate.json [Renovate] Improve logs-ux xstate rules (#211760) 2025-02-19 15:41:29 +01:00
RISK_MATRIX.mdx
run_fleet_setup_parallel.sh Sustainable Kibana Architecture: Move modules owned by @elastic/fleet (#202422) 2024-12-24 15:32:43 +01:00
SECURITY.md
sonar-project.properties [sonarqube] update memory, cpu (#190547) 2024-09-09 16:16:30 -05:00
STYLEGUIDE.mdx [styleguide] update path to scss theme (#140742) 2022-09-15 10:41:14 -04:00
tsconfig.base.json 🌊 Move streams to platform (#211893) 2025-02-21 16:34:50 +01:00
tsconfig.browser.json
tsconfig.browser_bazel.json
tsconfig.json Transpile packages on demand, validate all TS projects (#146212) 2022-12-22 19:00:29 -06:00
TYPESCRIPT.md Fix small typos in the root md files (#134609) 2022-06-23 09:36:11 -05:00
updatecli-compose.yaml deps(updatecli): bump all policies (#195865) 2024-10-15 07:37:12 -05:00
versions.json chore(NA): update versions after v8.17.3 bump (#210648) 2025-02-12 01:23:33 +00:00
WORKSPACE.bazel Upgrade Node.js to 20.18.2 (#207431) 2025-01-22 12:00:14 -06:00
yarn.lock 🌊 Move streams to platform (#211893) 2025-02-21 16:34:50 +01:00

Kibana

Kibana is your window into the Elastic Stack. Specifically, it's a browser-based analytics and search dashboard for Elasticsearch.

Getting Started

If you just want to try Kibana out, check out the Elastic Stack Getting Started Page to give it a whirl.

If you're interested in diving a bit deeper and getting a taste of Kibana's capabilities, head over to the Kibana Getting Started Page.

Using a Kibana Release

If you want to use a Kibana release in production, give it a test run, or just play around:

Building and Running Kibana, and/or Contributing Code

You might want to build Kibana locally to contribute some code, test out the latest features, or try out an open PR:

Documentation

Visit Elastic.co for the full Kibana documentation.

For information about building the documentation, see the README in elastic/docs.

Version Compatibility with Elasticsearch

Ideally, you should be running Elasticsearch and Kibana with matching version numbers. If your Elasticsearch has an older version number or a newer major number than Kibana, then Kibana will fail to run. If Elasticsearch has a newer minor or patch number than Kibana, then the Kibana Server will log a warning.

Note: The version numbers below are only examples, meant to illustrate the relationships between different types of version numbers.

Situation Example Kibana version Example ES version Outcome
Versions are the same. 7.15.1 7.15.1 💚 OK
ES patch number is newer. 7.15.0 7.15.1 ⚠️ Logged warning
ES minor number is newer. 7.14.2 7.15.0 ⚠️ Logged warning
ES major number is newer. 7.15.1 8.0.0 🚫 Fatal error
ES patch number is older. 7.15.1 7.15.0 ⚠️ Logged warning
ES minor number is older. 7.15.1 7.14.2 🚫 Fatal error
ES major number is older. 8.0.0 7.15.1 🚫 Fatal error

Questions? Problems? Suggestions?

  • If you've found a bug or want to request a feature, please create a GitHub Issue. Please check to make sure someone else hasn't already created an issue for the same topic.
  • Need help using Kibana? Ask away on our Kibana Discuss Forum and a fellow community member or Elastic engineer will be glad to help you out.