Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ES Query] Save ECS keyword group by fields in AAD document #191103

Merged
merged 7 commits into from
Aug 23, 2024
Merged

[ES Query] Save ECS keyword group by fields in AAD document #191103

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
1377672
Save ECS keyword group by fields in AAD document for ES query rule
maryam-saeidi Aug 22, 2024
da574d3
Use groupBucket.key to create groups instead of alertId
maryam-saeidi Aug 23, 2024
ee4bfd2
Merge branch 'main' into 183220-save-ecs-groups-in-aad-es-query
maryam-saeidi Aug 23, 2024
f0840e2
Fix test
maryam-saeidi Aug 23, 2024
dba44ca
Merge branch 'main' into 183220-save-ecs-groups-in-aad-es-query
maryam-saeidi Aug 23, 2024
17ccda1
Add a test for multiple termFields
maryam-saeidi Aug 23, 2024
b049cef
Merge branch 'main' into 183220-save-ecs-groups-in-aad-es-query
maryam-saeidi Aug 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions x-pack/plugins/stack_alerts/server/rule_types/es_query/executor.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,16 +377,19 @@ describe('es_query executor', () => {
results: [
{
group: 'host-1',
groups: [{ field: 'host.name', value: 'host-1' }],
count: 291,
hits: [],
},
{
group: 'host-2',
groups: [{ field: 'host.name', value: 'host-2' }],
count: 477,
hits: [],
},
{
group: 'host-3',
groups: [{ field: 'host.name', value: 'host-3' }],
count: 999,
hits: [],
},
Expand Down Expand Up @@ -429,6 +432,7 @@ describe('es_query executor', () => {
latestTimestamp: undefined,
},
payload: {
'host.name': 'host-1',
'kibana.alert.evaluation.conditions':
'Number of matching documents for group "host-1" is greater than or equal to 200',
'kibana.alert.evaluation.threshold': 200,
Expand Down Expand Up @@ -460,6 +464,7 @@ describe('es_query executor', () => {
latestTimestamp: undefined,
},
payload: {
'host.name': 'host-2',
'kibana.alert.evaluation.conditions':
'Number of matching documents for group "host-2" is greater than or equal to 200',
'kibana.alert.evaluation.threshold': 200,
Expand Down Expand Up @@ -491,6 +496,7 @@ describe('es_query executor', () => {
latestTimestamp: undefined,
},
payload: {
'host.name': 'host-3',
'kibana.alert.evaluation.conditions':
'Number of matching documents for group "host-3" is greater than or equal to 200',
'kibana.alert.evaluation.threshold': 200,
Expand Down
4 changes: 4 additions & 0 deletions x-pack/plugins/stack_alerts/server/rule_types/es_query/executor.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,11 @@
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/

import { sha256 } from 'js-sha256';
import { i18n } from '@kbn/i18n';
import { CoreSetup, Logger } from '@kbn/core/server';
import { getEcsGroups } from '@kbn/observability-alerting-rule-utils';
import { isGroupAggregation, UngroupedGroupId } from '@kbn/triggers-actions-ui-plugin/common';
import {
ALERT_EVALUATION_THRESHOLD,
Expand Down Expand Up @@ -178,6 +180,7 @@ export async function executor(core: CoreSetup, options: ExecutorOptions<EsQuery
});

const id = alertId === UngroupedGroupId && !isGroupAgg ? ConditionMetAlertInstanceId : alertId;
const ecsGroups = getEcsGroups(result.groups);

alertsClient.report({
id,
Expand All @@ -191,6 +194,7 @@ export async function executor(core: CoreSetup, options: ExecutorOptions<EsQuery
[ALERT_EVALUATION_CONDITIONS]: actionContext.conditions,
[ALERT_EVALUATION_VALUE]: `${actionContext.value}`,
[ALERT_EVALUATION_THRESHOLD]: params.threshold?.length === 1 ? params.threshold[0] : null,
...ecsGroups,
...actionContext.sourceFields,
},
});
Expand Down
1 change: 1 addition & 0 deletions x-pack/plugins/stack_alerts/server/rule_types/es_query/lib/fetch_search_source_query.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,7 @@ export async function fetchSearchSourceQuery({
isGroupAgg,
esResult: searchResult,
sourceFieldsParams: params.sourceFields,
termField: params.termField,
}),
index: [index.name],
query: searchRequestBody,
Expand Down
3 changes: 2 additions & 1 deletion x-pack/plugins/stack_alerts/tsconfig.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,8 @@
"@kbn/alerting-comparators",
"@kbn/task-manager-plugin",
"@kbn/core-logging-server-mocks",
"@kbn/core-saved-objects-server"
"@kbn/core-saved-objects-server",
"@kbn/observability-alerting-rule-utils"
],
"exclude": [
"target/**/*",
Expand Down
Loading