[Alerting] Display Action Group in Alert Details #82645

ymao1 · 2020-11-04T18:22:34Z

Resolves #82275

Summary

Adds action group id to event log when alert instances become active. Added new field kibana.alerting.action_group_id and updated message to include action group id. Event log entry looks like:

{
    "_index" : ".kibana-event-log-8.0.0-000001",
    "_id" : "fyG1inUB_AesnUpcNl87",
    "_score" : null,
    "_source" : {
        "event" : {
            "provider" : "alerting",
            "action" : "active-instance"
        },
        "kibana" : {
            "alerting" : {
                "instance_id" : "host-2",
                "action_group_id" : "threshold met"
            },
            "saved_objects" : [
                {
                    "rel" : "primary",
                    "type" : "alert",
                    "id" : "7502677e-f4d0-4a9a-b5b4-6d3a3072b76b"
                }
            ],
            "server_uuid" : "5b2de169-2785-441b-ae8c-186a1936b17d"
        },
        "message" : ".index-threshold:7502677e-f4d0-4a9a-b5b4-6d3a3072b76b: 'test alert' active instance: 'host-2' in actionGroup: 'threshold met'",
        "@timestamp" : "2020-11-02T20:45:33.114Z",
        "ecs" : {
            "version" : "1.5.0"
        }
    }
}

Adds action group name to alert details view when alert instances are active. Included it in the Status field based on this comment

If no action_group_id is available in the event log data, it will default to showing the default action group name

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

…status in alert details view

…ing/action-group-alert-details

elasticmachine · 2020-11-05T12:42:54Z

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

gmmorris

LGTM, just left a few thoughts... 👍

gmmorris · 2020-11-05T18:08:52Z

x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.test.ts

@@ -452,14 +534,17 @@ export class EventsFactory {
    return this;
  }

-  addActiveInstance(instanceId: string): EventsFactory {
+  addActiveInstance(instanceId: string, actionGroupId: string | undefined): EventsFactory {


When might an action not have an action group? 🤔
Just wondering if we need the undefined here...

Or is this for when we resolve?

I added the undefined in order to support the test 'alert with currently active instance with no action group in event log', which ensures we can handle event log entries from prior to this PR which won't have the action_group_id field.

...triggers_actions_ui/public/application/sections/alert_details/components/alert_instances.tsx

…ing/action-group-alert-details

YulNaumenko

LGTM!

pmuellr

LGTM! I did make one comment about a code change to avoid having to use ! because it scares me :-). Also a comment about opening an issue on how to deal with "action group changes" while the alert is active.

pmuellr · 2020-11-05T21:04:06Z

x-pack/plugins/event_log/scripts/mappings.js

@@ -18,6 +18,10 @@ exports.EcsKibanaExtensionsMappings = {
          type: 'keyword',
          ignore_above: 1024,
        },
+        action_group_id: {


cool - these changes to the event log mappings/schema gen tools look good, hope it was straight-forward, please update the relevant docs (READMEs?) if something was unclear

Yep! The schema generation was straightfoward.

pmuellr · 2020-11-05T21:32:36Z

x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.test.ts

+      .addActiveInstance('instance-1', 'action group A')
+      .advanceTime(10000)
+      .addExecute()
+      .addActiveInstance('instance-1', 'action group B')


This makes me wonder what kind of events we should be generating when an instance "switches" action groups. My first thought was it should probably send a resolved-instance with the old action group, and a new-instance with the new instance group, in between these active-instance events. Which implies sending the action groups on new-instance and resolved-instance as well.

But not sure. Perhaps it would be better to leave new-instance and resolved-instance as is, and maybe have a new event active-action-group-changed or such.

I think we'll need to think about this a little bit - create a new issue? ie "what events should be logged when an alert switches action groups".

Created this issue: #82792

x-pack/plugins/alerts/server/task_runner/task_runner.ts

kibanamachine · 2020-11-06T02:05:42Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 10e70e5

Metrics [docs]

async chunks size

id	before	after	diff
`triggersActionsUi`	1.5MB	1.5MB	+677.0B

History

💚 Build #86245 succeeded 2eab483
💚 Build #86016 succeeded de91169
💛 Build #85903 was flaky 2303e80
💔 Build #85897 failed 3d2c08b

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* Adding action group id to event log. Showing action group as part of status in alert details view * Simplifying getting action group id * Cleanup * Adding unit tests * Updating functional tests * Updating test * Fix types check * Updating test * PR fixes * PR fixes

ymao1 added 9 commits November 3, 2020 14:11

Adding action group id to event log. Showing action group as part of …

bcdda50

…status in alert details view

Simplifying getting action group id

10b8c14

Cleanup

9ca4eeb

Merge branch 'master' of https://github.com/elastic/kibana into alert…

7b0d9f7

…ing/action-group-alert-details

Adding unit tests

dc4b4da

Updating functional tests

3d2c08b

Updating test

3130434

Fix types check

2303e80

Updating test

de91169

ymao1 added Feature:Alerting release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) v7.11.0 v8.0.0 labels Nov 5, 2020

ymao1 marked this pull request as ready for review November 5, 2020 12:42

ymao1 requested a review from a team as a code owner November 5, 2020 12:42

gmmorris self-requested a review November 5, 2020 17:49

ymao1 self-assigned this Nov 5, 2020

gmmorris approved these changes Nov 5, 2020

View reviewed changes

Merge branch 'master' of https://github.com/elastic/kibana into alert…

7f4740f

…ing/action-group-alert-details

YulNaumenko approved these changes Nov 5, 2020

View reviewed changes

PR fixes

2eab483

pmuellr approved these changes Nov 5, 2020

View reviewed changes

pmuellr mentioned this pull request Nov 5, 2020

Ability to fire actions when an alert instance is resolved #49405

Closed

2 tasks

PR fixes

10e70e5

ymao1 mentioned this pull request Nov 6, 2020

Transition of alert instance from one action group to another #82792

Closed

ymao1 merged commit dae2851 into elastic:master Nov 6, 2020

ymao1 mentioned this pull request Nov 6, 2020

[7.x] [Alerting] Display Action Group in Alert Details (#82645) #82824

Merged

mikecote added release_note:enhancement and removed release_note:skip Skip the PR/issue when compiling release notes labels Dec 16, 2020

ymao1 deleted the alerting/action-group-alert-details branch February 4, 2021 15:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Alerting] Display Action Group in Alert Details #82645

[Alerting] Display Action Group in Alert Details #82645

ymao1 commented Nov 4, 2020 •

edited

Loading

elasticmachine commented Nov 5, 2020

gmmorris left a comment

gmmorris Nov 5, 2020

ymao1 Nov 5, 2020

YulNaumenko left a comment

pmuellr left a comment

pmuellr Nov 5, 2020

ymao1 Nov 6, 2020

pmuellr Nov 5, 2020

ymao1 Nov 6, 2020

kibanamachine commented Nov 6, 2020

[Alerting] Display Action Group in Alert Details #82645

[Alerting] Display Action Group in Alert Details #82645

Conversation

ymao1 commented Nov 4, 2020 • edited Loading

Summary

Checklist

elasticmachine commented Nov 5, 2020

gmmorris left a comment

Choose a reason for hiding this comment

gmmorris Nov 5, 2020

Choose a reason for hiding this comment

ymao1 Nov 5, 2020

Choose a reason for hiding this comment

YulNaumenko left a comment

Choose a reason for hiding this comment

pmuellr left a comment

Choose a reason for hiding this comment

pmuellr Nov 5, 2020

Choose a reason for hiding this comment

ymao1 Nov 6, 2020

Choose a reason for hiding this comment

pmuellr Nov 5, 2020

Choose a reason for hiding this comment

ymao1 Nov 6, 2020

Choose a reason for hiding this comment

kibanamachine commented Nov 6, 2020

💚 Build Succeeded

Metrics [docs]

async chunks size

History

ymao1 commented Nov 4, 2020 •

edited

Loading