Build a consolidated implementation (Draft)

x-pack/plugins/rule_registry/common/event_log/assets/common_component_templates.ts

@@ -0,0 +1,35 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { merge } from 'lodash';
+import { ComponentTemplateOptions } from '../definition';
+import { commonEcsMappings } from './schema/common_ecs_fields';
+import { technicalFieldMappings } from './schema/technical_fields';
+
+/**
+ * Based on these options the Event Log mechanism will create and maintain
+ * `.alerts-settings` component template.
+ */
+export const commonSettingsTemplate: ComponentTemplateOptions = {
+  version: 1,
+  settings: {
+    number_of_shards: 1,
+    auto_expand_replicas: '0-1',
+    'mapping.total_fields.limit': 10000,
+    'sort.field': '@timestamp',
+    'sort.order': 'desc',
+  },
+};
+
+/**
+ * Based on these options the Event Log mechanism will create and maintain
+ * `.alerts-mappings` component template.
+ */
+export const commonMappingsTemplate: ComponentTemplateOptions = {
+  version: 1,
+  mappings: merge({}, commonEcsMappings, technicalFieldMappings),
+};

x-pack/plugins/rule_registry/common/event_log/assets/common_schema.ts

@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { Schema } from '../definition';
+import { commonEcsSchema } from './schema/common_ecs_fields';
+import { technicalFieldSchema } from './schema/technical_fields';
+
+export const commonSchema = Schema.combine(commonEcsSchema, technicalFieldSchema);
+
+export type CommonFields = typeof commonSchema.event;

x-pack/plugins/rule_registry/server/event_log/elasticsearch/resources/ilm_policy.ts → x-pack/plugins/rule_registry/common/event_log/assets/default_ilm_policy.ts

@@ -5,29 +5,26 @@
  * 2.0.
  */
 
-import { estypes } from '@elastic/elasticsearch';
-
-export interface IlmPolicy {
-  policy: estypes.Policy;
-}
+import { IlmPolicy } from '../definition';
 
 export const defaultIlmPolicy: IlmPolicy = {
-  policy: {
-    phases: {
-      hot: {
-        min_age: '0ms',
-        actions: {
-          rollover: {
-            max_age: '90d',
-            max_size: '50gb',
-          },
+  phases: {
+    hot: {
+      min_age: '0ms',
+      actions: {
+        rollover: {
+          max_age: '30d',
+          max_primary_shard_size: '50gb',
         },
-      },
-      delete: {
-        actions: {
-          delete: {},
+        set_priority: {
+          priority: 100,
         },
       },
     },
+    delete: {
+      actions: {
+        delete: {},
+      },
+    },
   },
 };

x-pack/plugins/rule_registry/server/event_log/elasticsearch/resources/index_mappings.ts → x-pack/plugins/rule_registry/common/event_log/assets/index.ts

@@ -5,8 +5,6 @@
  * 2.0.
  */
 
-export interface IndexMappings {
-  dynamic: 'strict' | boolean;
-  properties: Record<string, { type: string } | IndexMappings>;
-  _meta?: Record<string, unknown>;
-}
+export * from './common_component_templates';
+export * from './common_schema';
+export * from './default_ilm_policy';

x-pack/plugins/rule_registry/common/event_log/assets/schema/common_ecs_fields.ts

@@ -0,0 +1,39 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { pickWithPatterns } from '../../../../common/pick_with_patterns';
+import {
+  TIMESTAMP,
+  TAGS,
+  EVENT_KIND,
+  EVENT_ACTION,
+  RULE_UUID,
+  RULE_ID,
+  RULE_NAME,
+  RULE_CATEGORY,
+} from '../../../../common/technical_rule_data_field_names';
+import { ecsFieldMap } from '../../../assets/field_maps/ecs_field_map';
+import { mappingFromFieldMap } from '../../../mapping_from_field_map';
+import { runtimeTypeFromFieldMap } from '../../../field_map/runtime_type_from_fieldmap';
+import { Schema } from '../../definition';
+
+export const commonEcsFieldMap = {
+  ...pickWithPatterns(
+    ecsFieldMap,
+    TIMESTAMP,
+    TAGS,
+    EVENT_KIND,
+    EVENT_ACTION,
+    RULE_UUID,
+    RULE_ID,
+    RULE_NAME,
+    RULE_CATEGORY
+  ),
+} as const;
+
+export const commonEcsMappings = mappingFromFieldMap(commonEcsFieldMap);
+export const commonEcsSchema = Schema.create(runtimeTypeFromFieldMap(commonEcsFieldMap));

x-pack/plugins/rule_registry/common/event_log/assets/schema/technical_fields.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import {
+  ALERT_DURATION,
+  ALERT_END,
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+  ALERT_ID,
+  ALERT_SEVERITY_LEVEL,
+  ALERT_SEVERITY_VALUE,
+  ALERT_START,
+  ALERT_STATUS,
+  ALERT_UUID,
+  PRODUCER,
+} from '../../../../common/technical_rule_data_field_names';
+import { mappingFromFieldMap } from '../../../mapping_from_field_map';
+import { runtimeTypeFromFieldMap } from '../../../field_map/runtime_type_from_fieldmap';
+import { Schema } from '../../definition';
+
+export const technicalFieldMap = {
+  [PRODUCER]: { type: 'keyword' },
+  [ALERT_UUID]: { type: 'keyword' },
+  [ALERT_ID]: { type: 'keyword' },
+  [ALERT_START]: { type: 'date' },
+  [ALERT_END]: { type: 'date' },
+  [ALERT_DURATION]: { type: 'long' },
+  [ALERT_SEVERITY_LEVEL]: { type: 'keyword' },
+  [ALERT_SEVERITY_VALUE]: { type: 'long' },
+  [ALERT_STATUS]: { type: 'keyword' },
+  [ALERT_EVALUATION_THRESHOLD]: { type: 'scaled_float', scaling_factor: 100 },
+  [ALERT_EVALUATION_VALUE]: { type: 'scaled_float', scaling_factor: 100 },
+} as const;
+
+export const technicalFieldMappings = mappingFromFieldMap(technicalFieldMap);
+export const technicalFieldSchema = Schema.create(runtimeTypeFromFieldMap(technicalFieldMap));

x-pack/plugins/rule_registry/common/event_log/definition/event_log_definition.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { EventSchema } from './event_schema';
+import { IlmPolicy } from './ilm_policy';
+import { Templates } from './index_template';
+
+export interface EventLogDefinition<TEvent> {
+  logName: string;
+  schema: EventSchema<TEvent>;
+  templates: Templates;
+  ilmPolicy?: IlmPolicy;
+}

x-pack/plugins/rule_registry/common/event_log/definition/event_schema.ts

@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+export interface EventSchema<TEvent> {
+  eventType: t.Type<TEvent>;
+  event: TEvent;
+}
+
+export abstract class Schema {
+  public static create<TEvent>(eventType: t.Type<TEvent>): EventSchema<TEvent> {
+    return {
+      eventType,
+      event: {} as t.TypeOf<typeof eventType>,
+    };
+  }
+
+  public static combine<T1, T2>(s1: EventSchema<T1>, s2: EventSchema<T2>): EventSchema<T1 & T2> {
+    const combinedType = t.intersection([s1.eventType, s2.eventType]);
+    return this.create(combinedType);
+  }
+}

x-pack/plugins/rule_registry/server/event_log/event_schema/index.ts → x-pack/plugins/rule_registry/common/event_log/definition/ilm_policy.ts

@@ -5,5 +5,6 @@
  * 2.0.
  */
 
-export * from './schema_types';
-export * from './schema';
+import { estypes } from '@elastic/elasticsearch';
+
+export type IlmPolicy = estypes.Policy;

x-pack/plugins/rule_registry/common/event_log/definition/index.ts

@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export * from './event_log_definition';
+export * from './event_schema';
+export * from './ilm_policy';
+export * from './index_names';
+export * from './index_template';

x-pack/plugins/rule_registry/server/event_log/elasticsearch/resources/index_names.ts → x-pack/plugins/rule_registry/common/event_log/definition/index_names.ts

@@ -29,14 +29,31 @@ export interface IndexNames extends IndexParams {
   /** @example '.alerts-security.alerts-default-*' */
   indexAliasPattern: string;
 
+  /** @example '.alerts-security.alerts-default-000001' */
+  indexInitialName: string;
+
   /** @example '.alerts-security.alerts-default-policy' */
   indexIlmPolicyName: string;
 
   /** @example '.alerts-security.alerts-default-template' */
   indexTemplateName: string;
 
-  /** @example '.alerts-security.alerts-default-000001' */
-  indexInitialName: string;
+  componentTemplates: {
+    /** @example '.alerts-mappings' */
+    commonMappingsTemplateName: string;
+
+    /** @example '.alerts-settings' */
+    commonSettingsTemplateName: string;
+
+    /** @example '.alerts-security.alerts-app' */
+    applicationDefinedTemplateName: string;
+
+    /** @example '.alerts-security.alerts-user' */
+    userDefinedTemplateName: string;
+
+    /** @example '.alerts-security.alerts-user-default' */
+    userDefinedSpaceAwareTemplateName: string;
+  };
 }
 
 export abstract class IndexNames {
@@ -49,9 +66,19 @@ export abstract class IndexNames {
     const indexBasePattern = joinWithDash(indexPrefix, logName, '*');
     const indexAliasName = joinWithDash(indexPrefix, logName, kibanaSpaceId);
     const indexAliasPattern = joinWithDash(indexPrefix, logName, kibanaSpaceId, '*');
+    const indexInitialName = joinWithDash(indexPrefix, logName, kibanaSpaceId, '000001');
     const indexIlmPolicyName = joinWithDash(indexPrefix, logName, kibanaSpaceId, 'policy');
     const indexTemplateName = joinWithDash(indexPrefix, logName, kibanaSpaceId, 'template');
-    const indexInitialName = joinWithDash(indexPrefix, logName, kibanaSpaceId, '000001');
+    const commonMappingsTemplateName = joinWithDash(indexPrefix, 'mappings');
+    const commonSettingsTemplateName = joinWithDash(indexPrefix, 'settings');
+    const applicationDefinedTemplateName = joinWithDash(indexPrefix, logName, 'app');
+    const userDefinedTemplateName = joinWithDash(indexPrefix, logName, 'user');
+    const userDefinedSpaceAwareTemplateName = joinWithDash(
+      indexPrefix,
+      logName,
+      'user',
+      kibanaSpaceId
+    );
 
     return {
       indexPrefix,
@@ -61,9 +88,16 @@ export abstract class IndexNames {
       indexBasePattern,
       indexAliasName,
       indexAliasPattern,
+      indexInitialName,
       indexIlmPolicyName,
       indexTemplateName,
-      indexInitialName,
+      componentTemplates: {
+        commonMappingsTemplateName,
+        commonSettingsTemplateName,
+        applicationDefinedTemplateName,
+        userDefinedTemplateName,
+        userDefinedSpaceAwareTemplateName,
+      },
     };
   }