[Event Log] add event.outcome to relevant event log documents (#64389)
resolves https://github.com/elastic/kibana/issues/61891 Adds a relatively new ECS field `event.outcome`. Value of `success`, `failure`, or `unknown`. This is nice, as the only way we have currently of determining an error for an alert or action execution in the log is the existence of an `error.message` field. It is added to to the documents for those events. see: https://www.elastic.co/guide/en/ecs/current/ecs-event.html
This commit is contained in:
parent
23665133d7
commit
5457a62fdb
6 changed files with 19 additions and 0 deletions
|
@ -140,13 +140,18 @@ export class ActionExecutor {
|
|||
status: 'ok',
|
||||
};
|
||||
|
||||
event.event = event.event || {};
|
||||
|
||||
if (result.status === 'ok') {
|
||||
event.event.outcome = 'success';
|
||||
event.message = `action executed: ${actionLabel}`;
|
||||
} else if (result.status === 'error') {
|
||||
event.event.outcome = 'failure';
|
||||
event.message = `action execution failure: ${actionLabel}`;
|
||||
event.error = event.error || {};
|
||||
event.error.message = actionErrorToMessage(result);
|
||||
} else {
|
||||
event.event.outcome = 'failure';
|
||||
event.message = `action execution returned unexpected result: ${actionLabel}`;
|
||||
event.error = event.error || {};
|
||||
event.error.message = 'action execution returned unexpected result';
|
||||
|
|
|
@ -165,6 +165,7 @@ describe('Task Runner', () => {
|
|||
Object {
|
||||
"event": Object {
|
||||
"action": "execute",
|
||||
"outcome": "success",
|
||||
},
|
||||
"kibana": Object {
|
||||
"saved_objects": Array [
|
||||
|
@ -226,6 +227,7 @@ describe('Task Runner', () => {
|
|||
Object {
|
||||
"event": Object {
|
||||
"action": "execute",
|
||||
"outcome": "success",
|
||||
},
|
||||
"kibana": Object {
|
||||
"saved_objects": Array [
|
||||
|
@ -342,6 +344,7 @@ describe('Task Runner', () => {
|
|||
Object {
|
||||
"event": Object {
|
||||
"action": "execute",
|
||||
"outcome": "success",
|
||||
},
|
||||
"kibana": Object {
|
||||
"saved_objects": Array [
|
||||
|
@ -558,6 +561,7 @@ describe('Task Runner', () => {
|
|||
},
|
||||
"event": Object {
|
||||
"action": "execute",
|
||||
"outcome": "failure",
|
||||
},
|
||||
"kibana": Object {
|
||||
"saved_objects": Array [
|
||||
|
|
|
@ -202,12 +202,16 @@ export class TaskRunner {
|
|||
event.message = `alert execution failure: ${alertLabel}`;
|
||||
event.error = event.error || {};
|
||||
event.error.message = err.message;
|
||||
event.event = event.event || {};
|
||||
event.event.outcome = 'failure';
|
||||
eventLogger.logEvent(event);
|
||||
throw err;
|
||||
}
|
||||
|
||||
eventLogger.stopTiming(event);
|
||||
event.message = `alert executed: ${alertLabel}`;
|
||||
event.event = event.event || {};
|
||||
event.event.outcome = 'success';
|
||||
eventLogger.logEvent(event);
|
||||
|
||||
// Cleanup alert instances that are no longer scheduling actions to avoid over populating the alertInstances object
|
||||
|
|
|
@ -41,6 +41,10 @@
|
|||
},
|
||||
"end": {
|
||||
"type": "date"
|
||||
},
|
||||
"outcome": {
|
||||
"ignore_above": 1024,
|
||||
"type": "keyword"
|
||||
}
|
||||
}
|
||||
},
|
||||
|
|
|
@ -41,6 +41,7 @@ export const EventSchema = schema.maybe(
|
|||
start: ecsDate(),
|
||||
duration: ecsNumber(),
|
||||
end: ecsDate(),
|
||||
outcome: ecsString(),
|
||||
})
|
||||
),
|
||||
error: schema.maybe(
|
||||
|
|
|
@ -53,6 +53,7 @@ exports.EcsEventLogProperties = [
|
|||
'event.start',
|
||||
'event.duration',
|
||||
'event.end',
|
||||
'event.outcome', // optional, but one of failure, success, unknown
|
||||
'error.message',
|
||||
'user.name',
|
||||
'kibana.server_uuid',
|
||||
|
|
Loading…
Reference in a new issue