Your window into the Elastic Stack
Find a file
Ryland Herrick b5ae056ac4
[Security Solution][Detections] ML Rules accept multiple ML Job IDs (#97073)
* Adds helper to normalize legacy ML rule field to an array

This will be used on read of rules, to normalize legacy rules while
avoiding an explicit migration.

* Fix our detection-specific ML search function

Luckily this was just a translation layer to our anomaly call, and the
underlying functions already accepted an array of strings.

* WIP: Run rules against multiple ML Job IDs

We don't yet support creation of rules with multiple job ids, either on
the API or the UI, but when we do they will work.

Note: the logic was previously to generate an error if the underlying
job was not running, but to still query and generate alerts. Extending
that logic to multiple jobs: if any are not running, we generate an
error but continue querying and generating alerts.

* WIP: updating ml rule schemas to support multiple job IDs

* Simplify normalization method

We don't care about null or empty string values here; those were
holdovers from copying the logic of normalizeThreshold and don't apply
to this situation.

* Move normalized types to separate file to fix circular dependency

Our use of NonEmptyArray within common/schemas seemed to be causing the
above; this fixes it for now.

* Normalize ML job_ids param at the API layer

Previous changes to the base types already covered the majority of
routes; this updates the miscellaneous helpers that don't leverage those
shared utilities.

At the DB level, the forthcoming migration will ensure that we always
have "normalized" job IDs as an array.

* Count stopped ML Jobs as partial failure during ML Rule execution

Since we continue to query anomalies and potentially generate alerts, a
"failure" status is no longer the most accurate for this situation.

* Update 7.13 alerts migration to allow multi-job ML Rules

This ensures that we can assume string[] for this field during rule
execution.

* Display N job statuses on rule details

* WIP: converts MLJobSelect to a multiselect

Unfortunately, the SuperSelect does not allow multiselect so we need to
convert this to a combobox. Luckily we can reuse most of the code here
and remain relatively clean.

Since all combobox options must be the same (fixed) height, we're
somewhat more limited than before for displaying the rows. The
truncation appears fine, but I need to figure out a way to display the
full description as well.

* Update client-side logic to handle an array of ML job_ids

* Marginally more legible error message

* Conditionally call our normalize helper only if we have a value

This fixes a type error where TS could not infer that the return value
would not be undefined despite knowing that the argument was never
undefined. I tried some fancy conditional generic types, but that didn't
work.

This is more analogous to normalizeThresholdObject now, anyway.

* Fix remaining type error

* Clean up our ML executor tests with existing contract mocks

* Update ML Executor tests with new logic

We now record a partial failure instead of an error.

* Add and update tests for new ML normalization logic

* Add and update integration tests for ML Rules

Ensures that dealing with legacy job formats continues to work in the
API.

* Fix a type error

These params can no longer be strings.

* Update ML cypress test to create a rule with 2 ML jobs

If we can create a rule with 2 jobs, we should also be able to create a
rule with 1 job.

* Remove unused constant

* Persist a partial failure message written by a rule executor

We added the result.warning field as a way to indicate that a partial
failure was written to the rule, but neglected to account for that in the
main rule execution code, which caused a success status to immediately
overwrite the partial failure if the rule execution did not otherwise
fail/short-circuit.
2021-04-15 21:27:43 -05:00
.ci [ci/baseline] check public API doc count to populate baseline metrics (#97320) 2021-04-15 17:12:52 -07:00
.github Extract License service from CCR and Watcher into license_api_guard plugin in x-pack (#95973) 2021-04-15 14:54:49 -07:00
api_docs Track API stats as part of ci (#95733) 2021-04-15 11:36:10 -04:00
config Add server.publicBaseUrl config (#85075) 2020-12-08 17:02:39 -07:00
dev_docs Add section on developer documentation into best practices docs (#95473) 2021-03-25 18:52:07 -04:00
docs Extract License service from CCR and Watcher into license_api_guard plugin in x-pack (#95973) 2021-04-15 14:54:49 -07:00
examples [Dashboard] Move all dashboard extract/inject into persistable state (#96095) 2021-04-12 12:25:03 -04:00
licenses Elastic License 2.0 (#90099) 2021-02-03 18:12:39 -08:00
packages [RAC] Populate Observability alerts table with data from alerts indices (#96692) 2021-04-15 18:25:50 +02:00
plugins [dev/cli] ensure plugins/ and all watch source dirs exist (#78973) 2020-09-30 10:20:44 -07:00
rfcs [rfc][skip-ci] Screenshot Mode Service (#93496) 2021-04-14 14:21:28 -07:00
scripts [kbn/optimizer] import source-map-support in script to avoid breaking jest snapshots (#96011) 2021-03-31 18:36:52 -07:00
src Extract License service from CCR and Watcher into license_api_guard plugin in x-pack (#95973) 2021-04-15 14:54:49 -07:00
tasks/config [KQL] Use cache and other performance improvements (#93319) 2021-03-08 10:21:15 -07:00
test [Discover] Unskip doc navigation functional test (#96948) 2021-04-15 19:58:19 +02:00
typings [RAC] Rule registry plugin (#95903) 2021-04-09 10:35:44 +02:00
utilities Elastic License 2.0 (#90099) 2021-02-03 18:12:39 -08:00
vars [ci] ship Jest unit test junit with runbld in jest worker (#97197) 2021-04-15 17:13:38 -07:00
x-pack [Security Solution][Detections] ML Rules accept multiple ML Job IDs (#97073) 2021-04-15 21:27:43 -05:00
.backportrc.json [backportrc] Adds 7.12 branch and bumps 7.x (#91883) 2021-02-18 12:23:30 -05:00
.bazelignore chore(NA): stop grouping bazel out symlink folders (#96066) 2021-04-01 14:16:14 -05:00
.bazeliskversion chore(NA): bump bazelisk to v1.7.5 (#92905) 2021-02-26 00:48:47 +00:00
.bazelrc chore(NA): manage npm dependencies within bazel (#92864) 2021-03-03 12:37:20 -05:00
.bazelrc.common chore(NA): @kbn/pm new commands to support development on Bazel packages (#96465) 2021-04-12 20:24:19 -04:00
.bazelversion chore(NA): bazel machinery installation on kbn bootstrap (#89469) 2021-01-28 00:51:01 +00:00
.browserslistrc [browserslist] remove unnecessary browsers (#89186) 2021-01-25 16:30:18 -07:00
.editorconfig .editorconfig MDX files should follow the same rules as MD (#96942) 2021-04-13 11:40:42 -04:00
.eslintignore Remove /src/legacy (#95510) 2021-04-06 09:25:36 +02:00
.eslintrc.js Remove /src/legacy (#95510) 2021-04-06 09:25:36 +02:00
.fossa.yml Adds FOSSA CLI configuration file (#70137) 2020-07-02 08:37:37 -07:00
.gitattributes [canvas] Color fixes + Storybook 5 (#34075) 2019-04-02 11:21:51 -05:00
.gitignore add bazel directory back to .gitignore so it doesn't end up committed 2021-04-01 13:17:56 -07:00
.i18nrc.json Index pattern field editor (#88995) 2021-02-18 12:00:43 -06:00
.node-version Bump Node.js from version 14.16.0 to 14.16.1 (#96382) 2021-04-07 14:31:10 -04:00
.npmrc chore(NA): assure puppeteer_skip_chromium_download is applied across every yarn install situation (#88346) 2021-01-14 18:00:23 +00:00
.nvmrc Bump Node.js from version 14.16.0 to 14.16.1 (#96382) 2021-04-07 14:31:10 -04:00
.prettierignore [dev] Replace sass-lint with stylelint (#86177) 2021-01-15 11:52:29 -06:00
.prettierrc Increase prettier line width to 100 (#20535) 2018-07-09 22:50:37 +02:00
.stylelintignore chore(NA): stop grouping bazel out symlink folders (#96066) 2021-04-01 14:16:14 -05:00
.stylelintrc Amsterdam helpers (#93701) 2021-03-10 10:27:16 -06:00
.telemetryrc.json [Telemetry] Full schema definition (#90273) 2021-03-01 18:30:51 +00:00
.yarnrc chore(NA): manage npm dependencies within bazel (#92864) 2021-03-03 12:37:20 -05:00
api-documenter.json Normalize EOL symbol in platform docs (#56021) 2020-01-27 18:42:45 +01:00
BUILD.bazel chore(NA): moving @elastic/datemath into bazel (#94665) 2021-04-01 22:51:32 +01:00
CODE_OF_CONDUCT.md Add CODE_OF_CONDUCT.md (#87439) 2021-02-23 09:01:51 +01:00
CONTRIBUTING.md Improvements to our developer guide (#67764) 2020-07-13 10:47:01 -04:00
FAQ.md propose language changes (#10709) 2017-03-05 12:10:32 -05:00
github_checks_reporter.json implementing github checks - second attempt (#35757) 2019-05-01 16:02:33 -05:00
Gruntfile.js Elastic License 2.0 (#90099) 2021-02-03 18:12:39 -08:00
Jenkinsfile [CI] Increase pipeline timeouts (#91587) 2021-02-16 15:23:06 -08:00
jest.config.integration.js [CI] Combines Jest unit tests (#89948) 2021-02-09 10:08:46 -08:00
jest.config.js Remove /src/legacy (#95510) 2021-04-06 09:25:36 +02:00
kibana.d.ts Remove /src/legacy (#95510) 2021-04-06 09:25:36 +02:00
LICENSE.txt Elastic License 2.0 (#90099) 2021-02-03 18:12:39 -08:00
NOTICE.txt [kbn-ui-shared-deps] Remove outdated polyfills (#96339) 2021-04-08 08:49:13 -05:00
package.json chore(NA): upgrade lmdb-store to 1.2.4 (#97275) 2021-04-15 21:57:35 +01:00
preinstall_check.js Elastic License 2.0 (#90099) 2021-02-03 18:12:39 -08:00
README.md Fix "Getting started" link in README (#84153) 2020-11-23 15:33:02 -05:00
renovate.json5 fix brushing on small multiples (#94505) 2021-03-15 12:25:47 -05:00
SECURITY.md Add security policy to the Kibana repository (#85407) 2020-12-10 09:26:00 -05:00
STYLEGUIDE.md chore(NA): tool to find plugins circular dependencies between plugins (#82867) 2020-11-30 22:19:32 +00:00
tsconfig.base.json Revert "TS Incremental build exclude test files (#95610)" (#96223) 2021-04-05 11:59:26 -07:00
tsconfig.browser.json Introduce TS incremental builds & move src/test_utils to TS project (#76082) 2020-09-03 14:20:04 +02:00
tsconfig.json Extract License service from CCR and Watcher into license_api_guard plugin in x-pack (#95973) 2021-04-15 14:54:49 -07:00
tsconfig.refs.json [Maps] Enable all zoom levels for all users (#96093) 2021-04-05 12:04:20 -04:00
tsconfig.types.json ui_actions service initial docs (#78902) 2020-09-30 16:44:29 +02:00
TYPESCRIPT.md Fixed grammar (#74725) 2020-08-11 06:40:22 -04:00
WORKSPACE.bazel chore(NA): @kbn/pm new commands to support development on Bazel packages (#96465) 2021-04-12 20:24:19 -04:00
yarn.lock chore(NA): upgrade lmdb-store to 1.2.4 (#97275) 2021-04-15 21:57:35 +01:00

Kibana

Kibana is your window into the Elastic Stack. Specifically, it's a browser-based analytics and search dashboard for Elasticsearch.

Getting Started

If you just want to try Kibana out, check out the Elastic Stack Getting Started Page to give it a whirl.

If you're interested in diving a bit deeper and getting a taste of Kibana's capabilities, head over to the Kibana Getting Started Page.

Using a Kibana Release

If you want to use a Kibana release in production, give it a test run, or just play around:

Building and Running Kibana, and/or Contributing Code

You might want to build Kibana locally to contribute some code, test out the latest features, or try out an open PR:

Documentation

Visit Elastic.co for the full Kibana documentation.

For information about building the documentation, see the README in elastic/docs.

Version Compatibility with Elasticsearch

Ideally, you should be running Elasticsearch and Kibana with matching version numbers. If your Elasticsearch has an older version number or a newer major number than Kibana, then Kibana will fail to run. If Elasticsearch has a newer minor or patch number than Kibana, then the Kibana Server will log a warning.

Note: The version numbers below are only examples, meant to illustrate the relationships between different types of version numbers.

Situation Example Kibana version Example ES version Outcome
Versions are the same. 5.1.2 5.1.2 💚 OK
ES patch number is newer. 5.1.2 5.1.5 ⚠️ Logged warning
ES minor number is newer. 5.1.2 5.5.0 ⚠️ Logged warning
ES major number is newer. 5.1.2 6.0.0 🚫 Fatal error
ES patch number is older. 5.1.2 5.1.0 ⚠️ Logged warning
ES minor number is older. 5.1.2 5.0.0 🚫 Fatal error
ES major number is older. 5.1.2 4.0.0 🚫 Fatal error

Questions? Problems? Suggestions?

  • If you've found a bug or want to request a feature, please create a GitHub Issue. Please check to make sure someone else hasn't already created an issue for the same topic.
  • Need help using Kibana? Ask away on our Kibana Discuss Forum and a fellow community member or Elastic engineer will be glad to help you out.