## Summary * Adds Bulk REST API and routes added for create, update, and delete * Loops over data and calls `alertClient` until alerting team gives us bulk to push down * Adds Unit tests Testing/Usage: Create in bulk: ```ts POST /api/detection_engine/rules/_bulk_create [{ ... rule_1}, { ... rule_2}] ``` see script ```ts ./post_rule_bulk.sh ``` Update in bulk: ```ts PUT /api/detection_engine/rules/_bulk_update [{ ... rule_1}, { ... rule_2}] ``` see script ```ts ./update_rule_bulk.sh ``` Delete in bulk: ```ts DELETE /api/detection_engine/rules/_bulk_delete [{"id": "rule_1"}, {"id": "rule_2"}] ``` or in case your client does not support bodies in DELETE ```ts POST /api/detection_engine/rules/_bulk_delete [{"id": "rule_1"}, {"id": "rule_2"}] ``` But try to use DELETE where possible see script ```ts ./delete_bulk.sh ``` Caveats and error handling....If you do not validate correctly you will still get back a `400` return code. If you do validate correctly but one or more objects have errors involving a conflict or not found, you will get back a 200, but the body message will contain an array of errors or successes. Examples: If you delete in bulk for two objects but both do not have any values you get a response of `200` but then these errors in the array: ```ts ./delete_bulk.sh [ { "id": "query-rule-id-1", "error": { "statusCode": 404, "message": "rule_id: \"query-rule-id-1\" not found" } }, { "id": "query-rule-id-2", "error": { "statusCode": 404, "message": "rule_id: \"query-rule-id-2\" not found" } } ] ``` If one has a valid deleted value but the second does not you get a status of `200` and one object back as being deleted but the second as an error: ```ts ./delete_bulk.sh [ { "created_at": "2019-12-19T04:12:26.470Z", "updated_at": "2019-12-19T04:12:26.470Z", "created_by": "elastic_kibana", "description": "Query with a rule_id that acts like an external id", "enabled": true, "false_positives": [], "from": "now-6m", "id": "46d83e70-982a-4ba8-9ac1-fc386643c014", "immutable": false, "interval": "5m", "rule_id": "query-rule-id-1", "language": "kuery", "output_index": ".siem-signals-frank-hassanabad-default", "max_signals": 100, "risk_score": 1, "name": "Query with a rule id Number 1", "query": "user.name: root or user.name: admin", "references": [], "severity": "high", "updated_by": "elastic_kibana", "tags": [], "to": "now", "type": "query", "threats": [], "version": 1 }, { "id": "query-rule-id-2", "error": { "statusCode": 404, "message": "rule_id: \"query-rule-id-2\" not found" } } ] ``` Another example where an update has two errors because it tried to update two docs but both do not exist yet you get back a response of `200` but this array of errors: ```ts ./update_rule_bulk.sh <<< [ { "id": "query-rule-id-1", "error": { "statusCode": 404, "message": "rule_id: \"query-rule-id-1\" not found" } }, { "id": "query-rule-id-2", "error": { "statusCode": 404, "message": "rule_id: \"query-rule-id-2\" not found" } } ] ``` If one is updatable but the other is not you get back a response of `200` and one update back but the other is an error: ```ts ./update_rule_bulk.sh [ { "created_at": "2019-12-19T04:15:43.739Z", "updated_at": "2019-12-19T04:16:01.633Z", "created_by": "elastic_kibana", "description": "Query with a rule_id that acts like an external id", "enabled": true, "false_positives": [], "from": "now-6m", "id": "c1fcea2c-cbc6-4f28-b7e7-32b4d7cb799d", "immutable": false, "interval": "5m", "rule_id": "query-rule-id-1", "language": "kuery", "output_index": ".siem-signals-frank-hassanabad-default", "max_signals": 100, "risk_score": 1, "name": "Rule id Number 1 with an updated name", "query": "user.name: root or user.name: admin", "references": [], "severity": "high", "updated_by": "elastic_kibana", "tags": [], "to": "now", "type": "query", "threats": [], "version": 2 }, { "id": "query-rule-id-2", "error": { "statusCode": 404, "message": "rule_id: \"query-rule-id-2\" not found" } } ] ``` Same thing goes with posts and any other bulk actions. ### Checklist Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR. ~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~ ~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~ ~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~ - [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios ~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~ ### For maintainers ~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~ - [x] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process) |
||
---|---|---|
.ci | ||
.github | ||
bin | ||
common/graphql | ||
config | ||
data | ||
docs | ||
examples | ||
licenses | ||
packages | ||
rfcs | ||
scripts | ||
src | ||
style_guides | ||
tasks | ||
test | ||
typings | ||
utilities | ||
vars | ||
webpackShims | ||
x-pack | ||
.backportrc.json | ||
.browserslistrc | ||
.editorconfig | ||
.eslintignore | ||
.eslintrc.js | ||
.gitattributes | ||
.gitignore | ||
.i18nrc.json | ||
.node-version | ||
.nvmrc | ||
.prettierrc | ||
.sass-lint.yml | ||
.yarnrc | ||
CONTRIBUTING.md | ||
FAQ.md | ||
github_checks_reporter.json | ||
Gruntfile.js | ||
Jenkinsfile | ||
kibana.d.ts | ||
LICENSE.txt | ||
NOTICE.txt | ||
package.json | ||
preinstall_check.js | ||
README.md | ||
renovate.json5 | ||
STYLEGUIDE.md | ||
tsconfig.browser.json | ||
tsconfig.json | ||
tsconfig.types.json | ||
TYPESCRIPT.md | ||
yarn.lock |
Kibana
Kibana is your window into the Elastic Stack. Specifically, it's a browser-based analytics and search dashboard for Elasticsearch.
- Getting Started
- Documentation
- Version Compatibility with Elasticsearch
- Questions? Problems? Suggestions?
Getting Started
If you just want to try Kibana out, check out the Elastic Stack Getting Started Page to give it a whirl.
If you're interested in diving a bit deeper and getting a taste of Kibana's capabilities, head over to the Kibana Getting Started Page.
Using a Kibana Release
If you want to use a Kibana release in production, give it a test run, or just play around:
- Download the latest version on the Kibana Download Page.
- Learn more about Kibana's features and capabilities on the Kibana Product Page.
- We also offer a hosted version of Kibana on our Cloud Service.
Building and Running Kibana, and/or Contributing Code
You might want to build Kibana locally to contribute some code, test out the latest features, or try out an open PR:
- CONTRIBUTING.md will help you get Kibana up and running.
- If you would like to contribute code, please follow our STYLEGUIDE.md.
- Learn more about our UI code with UI_SYSTEMS.md.
- For all other questions, check out the FAQ.md and wiki.
Documentation
Visit Elastic.co for the full Kibana documentation.
For information about building the documentation, see the README in elastic/docs.
Version Compatibility with Elasticsearch
Ideally, you should be running Elasticsearch and Kibana with matching version numbers. If your Elasticsearch has an older version number or a newer major number than Kibana, then Kibana will fail to run. If Elasticsearch has a newer minor or patch number than Kibana, then the Kibana Server will log a warning.
Note: The version numbers below are only examples, meant to illustrate the relationships between different types of version numbers.
Situation | Example Kibana version | Example ES version | Outcome |
---|---|---|---|
Versions are the same. | 5.1.2 | 5.1.2 | 💚 OK |
ES patch number is newer. | 5.1.2 | 5.1.5 | ⚠️ Logged warning |
ES minor number is newer. | 5.1.2 | 5.5.0 | ⚠️ Logged warning |
ES major number is newer. | 5.1.2 | 6.0.0 | 🚫 Fatal error |
ES patch number is older. | 5.1.2 | 5.1.0 | ⚠️ Logged warning |
ES minor number is older. | 5.1.2 | 5.0.0 | 🚫 Fatal error |
ES major number is older. | 5.1.2 | 4.0.0 | 🚫 Fatal error |
Questions? Problems? Suggestions?
- If you've found a bug or want to request a feature, please create a GitHub Issue. Please check to make sure someone else hasn't already created an issue for the same topic.
- Need help using Kibana? Ask away on our Kibana Discuss Forum and a fellow community member or Elastic engineer will be glad to help you out.