This is a pre-cursor to https://github.com/elastic/kibana/issues/58529
I realized a bit ago that we weren't making quite enough info available
in the action parameter templating that happens when alerts schedule
actions to execute. Missing were alert name, tags, and spaceId.
For the index threshold alert, I had added them to it's context, but
then every other action would have to do the same if they also
wanted those values.
So I added these as additional top-level variables that can be
used in templates, along with the alert id, alert instance id,
context, and state. The other bits in RawAlert didn't seem
that interesting, to be used as an action parameter.
* add management section to SavedObjectsType
* adapt import/export routes to get types accessor
* add documentation
* update generated doc
* update migration guide
* use request context to access exportable types
* update generated doc
* adapt SavedObjectsManagement to use the registry
* stop magical tricks about the config type, register it as any other so type.
* fix FTR assertions
* fix so_mixin tests
* register the `config` type from the uiSettings service
* nits and comments
* update generated doc
* remove true from dynamic property definition, use force-cast back for config type
* remove obsolete test comment
Prior to this PR, the alerting UI used two HTTP endpoints provided by the
Kibana watcher plugin, to list index and field names. There are now two HTTP
endpoints in the alerting_builtins plugin which will be used instead.
The code for the new endpoints was largely copied from the existing watcher
endpoints, and the HTTP request/response bodies kept pretty much the same.
resolves https://github.com/elastic/kibana/issues/53041
* Exclude disallowed, private setting at index creation
* Remove intl from tabs component
* Added logic for checking the current index status
* Added ES contract integration test
Using _cluster/state is considered internal. This adds an integration
test for checking the contract in CI.
* Add the client side notification for closed indices
* First version of end-to-end functionality working
* Clean up unused, incorrect type information
* Fix type issues and added a comment about the new reindex options
* Fixed server side tests, added comments and logic updates
Updated the handling of reindexOptions to make it more
backwards compatible (treat it as if it could be undefined).
Also update the logic for checking for open or closed indices.
No optional chaining! It should break if the response does not
exactly match.
* Clean up unused code
* Improved idempotency of test and check explicitly for "close".
Rather check for the specific value we want, as this is what is
also gauranteed by the tests. In this way, the information we
send back to the client is also more accurate regarding the index
status. If, in future, more index states are introduced this will
need to be revisited if it affects the ability for an index to be
re-indexed.
* Update client-side tests
* Fix types
* Handle a case where the index name provided may be an alias
* Fix types
* merge-conflict: finish merge conflict resolution
* Update x-pack/plugins/upgrade_assistant/public/application/components/tabs/checkup/deprecations/reindex/closed_warning_icon.tsx
Co-Authored-By: Alison Goryachev <alisonmllr20@gmail.com>
* merge-conflict: Remove duplicate import
VSCode does not auto-save as expected :sigh:
* ui: Revisit the UI
Moved the warning icon to inside of the button and tooltip to
on the button.
Added a callout to the reindex flyout for when an index is closed.
* logic: slight update to when the index closed callout is shown
We only show the index closed callout in the flyout when the
reindex operation is not considered "completed"
* tests: fix jest tests
* refactor: remove "openAndClose" from reindex endpoints
"openAndClose" should just happen automatically. The user should
not have to pass the flag in, that would be a weird API. We just
need to warn the user about that reindexing a closed index will
take more resources
* test: update upgrade assistant integration test
* fix: types
* copy: use sentence case
* refactor: use the in scope declaration of reindex op
* test: Clean up tests
Reindexing test was generating index name, could just get it from
server response. Also removed openAndClose from all integration
tests
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Alison Goryachev <alisonmllr20@gmail.com>
* use inline snapshots instead of snapshots
* hide input value from error messages
* update core snapshots
* update xpack snapshots
* fix ftr assertions
* fix new snapshots
* hide values for byte_size and duration
* update new snapshots
* remove another byte_size value reference
* fix yet another value references in error messages
* update xpack snapshots
* update xpack ftr assertions
Migrates the client side plugin of transforms to NP.
- Gets rid of the last parts of the shim (http, documentation links)
- Moves the plugin from x-pack/legacy/plugins/transform/public to x-pack/plugins/transform
- Creates a custom mock for appDependencies based on NP services
- Fixes jest tests to get rid of all act() related warnings
* Unifying the test index name for resolver and alerts
* Endpoint isn't sending the agent field so check for it
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
* Added server side logic for handling batch reindex
* Remove literal string interpolation from translation
* Refactor return value of batch endpoint
"sucesses" does not communicate accurately what has happened.
"started" more closely reflects what has happened.
* First iteration of batch queues
* Single queue
Changed the batchqueues implementation to only using a single queue
- since there is only one ES that it is interacting with.
Before continuing with this work, just making sure that these pre-
cautions are necessary!
* Clean up old batch queue implementation
* Slight refactor
* Revert batch queues implementation
* Introduction of QueueSettings
Queue settings can be set on a reindex operation and set a
timemstamp value on the reindex operation for the scheduler
to use down the line for ordering operations and running them
in series
* Updated worker logic to handle items in queue in series
* Refactor /batch endpoint response to "enqueued" not "started"
* Fixed jest tests
* Refactor worker refresh operations for readability
Created a new file op_utils where logic repsonsible for sorting
and ordering reindex operation saved objects is.
* Add batch API integration test
Also assert that reindexing is happening in the expected order
* Added a new endpoint: GET batch/queue
This allows users of the API to see what the current queue state
is for visibility. Using the queue endpoint int he API integration
tests for batch too.
* Reset the queuedAt timestamp on resume
If a reindexOperation is being resumed and put in a queue we
also need to reset the queuedAt timestamp to respect the new
batch queue ordering.
* Fix jest test
Added 'undefined' as the second optional param to
resumeIndexOperation call.
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
* Add custom action to registry and show actions list in siem
* Exposed action form as reusable component
* Fixed few small bugs
* Fixed red ci
* Fixed type checks
* Fixed failed tests
* Fixed due to comments
* Fixed type check errors
* Fixed plugin check
* Rebalancing CI groups according to #58930
* Fixed merge issues
* Added possibility to embed connectors flyout
* Fixed type checks and removed example from siem start page
* Fixed jest tests
* Fixed failing tests
* fixed type check
* Added config for siem tests
* Fixed failing tests
* Fixed due to comments
* Added missing documentation
* [ML] Add support for date_nanos time field in anomaly job wizard
* [ML] Edits following review
* [ML] Add functional test for creating job off date_nanos data
* Implemented edit alert functionality
* Added unit tests
* Added functional test for edit alert
* Fixed failed tests
* Fixed edit api
* Fixed due to comments
* Fixed functional test
* Fixed tests
* Fixed add alert
* Small type fix
* Fixed jest test
* Fixed type check
* Fixed bugs with interval and throttle + index threshold expression
* Define a very basic SiemClient
We're going to add our client to the route handler context. Currently,
it's sole purpose is to provide us with the signalsIndex to use for the
request.
This will allow us to stop passing around most uses of config and
getSpaceId, as they were used for this same purpose.
* WIP: Convert first DE route to NP
This is one of the more comprehensive routes, so I think we're good to
convert the rest.
* Abstract joi/NP validator to helper
We're gonna need this all over the place. Until our schema can generate
an NP-compatible type, we can use this helper to generate an equivalent
validator.
* Second route down
* Another one
* updateRulesRoute
* Fix exports
* patchRulesRoute
* Normalize request param type names
* findRulesRoute
* addPrepackagedRulesRoute
* getPrepackagedRulesStatusRoute
* createRulesBulkRoute
* updateRulesBulkRoute
* patchRulesBulkRoute
* deleteRulesBulkRoute
* importRulesRoute
* exportRulesRoute
* findRulesStatusesRoute
* setSignalsStatusRoute
* querySignalsRoute
* Remove unused type
* createIndexRoute
* Convert readIndexRoute
Removes support for a HEAD request here, becuase it was only used by the
signal_index_exists script (which is now gone). A GET request will have
the same semantics, with a few more bytes in the response.
* deleteIndexRoute
* readTagsRoute
* readPrivilegesRoute
We're incorrectly accessing request.auth in here still, fixing that
next.
* We are always authenticated until we support optional auth
* Clean up our route initialization
* Remove our now-unused ClientsService
* Remove unused getIndex helper and references
* Remove legacy route initialization (partial application)
All our routing tests are still totally broken. Coming up!
* Reference name property in context registration
This should be replaced with a reference to the constant, but at least
this doesn't add a third way it's being referenced.
* Convert our first route tests to NP
The API for our test utils isn't final, but this at least gets some
tests passing. We'll see how it handles a more complex example.
* Create Rules tests
* Update addPrepackagedRules tests
There were a lot of incorrect tests in here due to some incorrect route
registration: we were asserting a 404 but receiving a false positive
because the route we wanted didn't exist.
* Read Privileges Route tests
* Delete Rules route tests
* Use more permissive validation in request mock
* createRulesBulkRoute tests
* deleteRulesBulkRoute tests
* More explicit result mock
It was very unclear in the tests what this mock represented.
* findRulesRoute tests
* getPrepackagedRulesRoute tests
* PatchRulesBulkRoute tests
* Convert migrated tests to newest interface
* PatchRulesRoute tests
Also fixes a potential false positive in our patch_rule_bulk_route
validation tests by providing a more realistic payload with a single key
missing.
* Rename file for consistency
* UpdateRulesBulkRoute tests
* deleteRulesBulkRoute tests
* findRulesStatusRoute tests
* updateRulesRoute tests
* setSignalStatusRoute tests
* querySignalsRoute tests
This actually caught a bug where we were not resolving our response before returning
* Update schema tests following rename of type
* Converts Import Rules route tests to NP form
Most of these tests are failing due to our request not being parsed by
Hapi as it previously was. Once we figure out how to generate a
post-middleware request with a file stream, these should be easily
fixed.
* Remove unused import
This was the last remaining reference to hapi in our server plugin. yay!
* Remove unnecessary tests
We're already covering our error paths here.
* Hit success branch of bulk patch route test
* Add test around error path in our route
* Update our router to validate requests by default
This gives us two important behaviors:
1. Requests to inject() will be populated with default values
2. We can test request validation independent of a handler call
* This allows more straightforward assertions as we don't have to
disambiguate between a schema rejection and a data rejection.
* Update route validation tests with new interface
We don't need to reach into our route in the test, nor ts-ignore it.
* Update ImportRules route tests for NP testing
Gets rid of the multipart-form processing that Hapi would convert for us
into a Readable stream. Instead, we generate our own post-middleware
requst that's got a stream on it.
* Remove unnecessary router method
A bug in an initial implementation of inject() lead me to believe that
validations were removing the stream from our requests; this turned out
to be false! YAGNI
* Add an adapter for our route responses
This provides a uniform interface of { body, status, calls }, where body
and status come from the highest-status call (in the case of many). In a
case where we build multiple responses, the preference is to return the
most problematic one first. If there's an issue, one can look into the
other calls and see what's going on.
This breaks the tests and is not fully implemented, but this will allow
us to change how we build responses without affecting our tests.
* Fix remaining assertions in one test file
Helped flesh out our adapter a bit more.
* Update our response adapter to represent how NP transforms our errors
Most importantly, we return a statusCode but not a status_code.
* Update tests to interface with our Response type
This makes them robust to framework/implementation changes.
* Generate our error responses with our siemResponse wrapper
This adds the status_code key that we desire in our error responses.
Tests were updated as well, and they're currently failing because they
expect statusCode, not status_code.
* Update test assertions to look for status_code
* Remove unused import
* Return a meaningful error if an invalid request was injected
This ensures we a) mimic platform behavior so that b) we don't risk a
false positive if our invalid request were to somehow succeed.
* Return a useful error when no route has been registered
* Add back POST variant of delete_rules_bulk_route
Some browsers do not support a request body for DELETE requests.
* Allow headers to be passed to our error response
This is used by Apollo to set some cache/allow headers in the case of
specific bad requests.
* Add back our header-passing from Apollo errors
I also inverted the logic here to handle the special case first.
* Add some tests around our error response helper
* Fix types of our error wrapper
* Move router logic into separate function
This could be decomposed further but getRoute becomes more verbose, so
meh.
* Convert our mock server to a class
It makes the shared state (mocks) of these functions more explicit, and also
does away with some dumb tuple-returns I had (a consequence of trying to
make everything pure).
* Remove need for a route spy
Instead of mocking certain router methods with the same spy and then
retrieving its calls, we can simply iterate over the calls of the router
methods we care about. This is a little less logic and a little more
straightforward.
* Update test with updated copy
We're consolidating on "signals index" when referring to the data index
where signals are stored.
* Remove unneeded type assertion from our route validation factory
We implicitly cast our return value here when we provide the generic
type parameter, so there's no reason for the explicit cast.
* Use exact message assertions
* Export our SiemRequestContext type for consumers
This will move to server/index in NP.
* Make our SiemClient properties readonly
We don't want consumers mutating our state.
* Throw error if SiemClientFactory has not been properly set up
* Remove unnecessary spread
* Use reduce's type argument instead of an explicit assertion
* Remove unnecessary optional chaining
This was a holdover from when we captured calls that had no body, but is
now unnecessary.
* Remove unnecessary headers on mock requests
* Remove non-null assertion in favor of constructor assignment
* Prefer type annotations to explicit casting
If we annotate that both incoming pieces of our headers are of the
correct type, then we can spread them into an object of the same type
and avoid the index signature issue.
* Skip test failure do to handling of authentication
We need to thread through the utility that provides us this same
functionality.
* Mock our cluster calls with realistic data
* Remove TODO as this is addressed in a later PR
Co-authored-by: Josh Dover <me@joshdover.com>
This is a follow-on to https://github.com/elastic/kibana/pull/57030 ,
"[alerting] initial index threshold alertType and supporting APIs",
to get it working with the existing alerting UI. The parameter shape
was different between the two, so the alertType was changed to fix
the existing UI shapes expected.
* [Maps] direct Discover visualize to Maps application
* pass initial layers to maps app
* add functional test
* fix parentheses messed up by lint fix
* fix i18n expression
* move logic into lib
* fix typescript errors
* use constant for geo_point and geo_shape, more TS noise
* use encode_array in an attempt to make TS happy
* another round of TS changes
* one more thing
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
* Add tabs to the Endpoint app. Uses EuiTabs and browser history for integration with react-router
Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Adds the first built-in alertType for Kibana alerting, an index threshold alert, and associated HTTP endpoint to generate preview data for it.
addresses the server-side requirements for issue https://github.com/elastic/kibana/issues/53041
* Add KQL filtering
* Schema updates
* Cursor-based pagination
* Add alert detail GET api
* A little refactoring ;)
* Add KQL filtering
* Render SearchBar that provides suggestions and executes search
* Schema updates
* Cursor-based pagination
* Bug fix with search_after type
* hook up filters, trying date range
* Multi-filter support
* Add rison encoding/decoding on the backend
* Wire up front-end for new GET request
* tiny bug fix
* use redux for state, disable saved queries
* Remove SearchBar UI code
* Remove Search Bar UI Part 2
* test 1
* test 2
* Finish integrating refactor work
* Fix fromIndex calculation
* Address feedback
* More tweaks
* Add some tests, round 1
* Add Direction enum
* Add next and prev urls for alert details
* refactor
* fixes
* No more AlertDataWrapper, less Maybe types
* change @timestamp to type number, redefine AlertListState
* moved pagination classes, moved types to alerts top level
* remove fake data mappings file
* Fix data location
* remove Maybe type, prev and next have type 'string | null'
* fix functional tests
* Create immutable AlertEvent type and an AlertMetadata type
* test updates
* make tests werk
* Address PR feedback
* No Date Immutable
* Fix test params
* Fix test type-check
Co-authored-by: Pedro Jaramillo <peluja1012@gmail.com>
