maxmustermann/kibana
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
No description
29602 commits 329 branches 211 tags 6.1 GiB
TypeScript 91.3%
JavaScript 7.7%
SCSS 0.3%
Shell 0.2%
CSS 0.2%
Other 0.1%
Find a file
Frank Hassanabad 7c2a71399c
[SIEM][Detection Engine] Bulk REST API for create, update, and delete 
## Summary

* Adds Bulk REST API and routes added for create, update, and delete
* Loops over data and calls `alertClient` until alerting team gives us bulk to push down
* Adds Unit tests

Testing/Usage:

Create in bulk:
```ts
POST /api/detection_engine/rules/_bulk_create
[{ ... rule_1}, { ... rule_2}]
```
see script
```ts
 ./post_rule_bulk.sh
```

Update in bulk:
```ts
PUT /api/detection_engine/rules/_bulk_update
[{ ... rule_1}, { ... rule_2}]
```

see script
```ts
 ./update_rule_bulk.sh
```

Delete in bulk:
```ts
DELETE /api/detection_engine/rules/_bulk_delete
[{"id": "rule_1"}, {"id": "rule_2"}]
```

or in case your client does not support bodies in DELETE
```ts
POST /api/detection_engine/rules/_bulk_delete
[{"id": "rule_1"}, {"id": "rule_2"}]
```

But try to use DELETE where possible

see script
```ts
./delete_bulk.sh
```

Caveats and error handling....If you do not validate correctly you will still get back a `400` return code. If you do validate correctly but one or more objects have errors involving a conflict or not found, you will get back a 200, but the body message will contain an array of errors or successes.

Examples:

If you delete in bulk for two objects but both do not have any values you get a response of `200` but then these errors in the array:

```ts
./delete_bulk.sh 
[
  {
    "id": "query-rule-id-1",
    "error": {
      "statusCode": 404,
      "message": "rule_id: \"query-rule-id-1\" not found"
    }
  },
  {
    "id": "query-rule-id-2",
    "error": {
      "statusCode": 404,
      "message": "rule_id: \"query-rule-id-2\" not found"
    }
  }
]
```

If one has a valid deleted value but the second does not you get a status of `200` and one object back as being deleted but the second as an error:

```ts
./delete_bulk.sh                        
[
  {
    "created_at": "2019-12-19T04:12:26.470Z",
    "updated_at": "2019-12-19T04:12:26.470Z",
    "created_by": "elastic_kibana",
    "description": "Query with a rule_id that acts like an external id",
    "enabled": true,
    "false_positives": [],
    "from": "now-6m",
    "id": "46d83e70-982a-4ba8-9ac1-fc386643c014",
    "immutable": false,
    "interval": "5m",
    "rule_id": "query-rule-id-1",
    "language": "kuery",
    "output_index": ".siem-signals-frank-hassanabad-default",
    "max_signals": 100,
    "risk_score": 1,
    "name": "Query with a rule id Number 1",
    "query": "user.name: root or user.name: admin",
    "references": [],
    "severity": "high",
    "updated_by": "elastic_kibana",
    "tags": [],
    "to": "now",
    "type": "query",
    "threats": [],
    "version": 1
  },
  {
    "id": "query-rule-id-2",
    "error": {
      "statusCode": 404,
      "message": "rule_id: \"query-rule-id-2\" not found"
    }
  }
]
```

Another example where an update has two errors because it tried to update two docs but both do not exist yet you get back a response of `200` but this array of errors:

```ts
./update_rule_bulk.sh                                                                                                                        <<<
[
  {
    "id": "query-rule-id-1",
    "error": {
      "statusCode": 404,
      "message": "rule_id: \"query-rule-id-1\" not found"
    }
  },
  {
    "id": "query-rule-id-2",
    "error": {
      "statusCode": 404,
      "message": "rule_id: \"query-rule-id-2\" not found"
    }
  }
]
```

If one is updatable but the other is not you get back a response of `200` and one update back but the other is an error:

```ts
./update_rule_bulk.sh
[
  {
    "created_at": "2019-12-19T04:15:43.739Z",
    "updated_at": "2019-12-19T04:16:01.633Z",
    "created_by": "elastic_kibana",
    "description": "Query with a rule_id that acts like an external id",
    "enabled": true,
    "false_positives": [],
    "from": "now-6m",
    "id": "c1fcea2c-cbc6-4f28-b7e7-32b4d7cb799d",
    "immutable": false,
    "interval": "5m",
    "rule_id": "query-rule-id-1",
    "language": "kuery",
    "output_index": ".siem-signals-frank-hassanabad-default",
    "max_signals": 100,
    "risk_score": 1,
    "name": "Rule id Number 1 with an updated name",
    "query": "user.name: root or user.name: admin",
    "references": [],
    "severity": "high",
    "updated_by": "elastic_kibana",
    "tags": [],
    "to": "now",
    "type": "query",
    "threats": [],
    "version": 2
  },
  {
    "id": "query-rule-id-2",
    "error": {
      "statusCode": 404,
      "message": "rule_id: \"query-rule-id-2\" not found"
    }
  }
]
```

Same thing goes with posts and any other bulk actions.

### Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

~~- [ ] This was checked for cross-browser compatibility, [including a check against IE11](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility)~~

~~- [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)~~

~~- [ ] [Documentation](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#writing-documentation) was added for features that require explanation or tutorials~~

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

~~- [ ] This was checked for [keyboard-only and screenreader accessibility](https://developer.mozilla.org/en-US/docs/Learn/Tools_and_testing/Cross_browser_testing/Accessibility#Accessibility_testing_checklist)~~

### For maintainers

~~- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)~~

- [x] This includes a feature addition or change that requires a release note and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)
2019-12-19 13:55:27 -07:00
.ci Add top level examples folder and command to run, --run-examples. (#52027) 2019-12-10 18:02:03 -05:00
.github adding canvas actions (#53163) 2019-12-19 13:51:53 -06:00
bin
common/graphql
config Instrument Kibana with APM RUM agent (#44281) 2019-12-18 12:16:15 +01:00
data
docs [Maps] Label style properties (#52957) 2019-12-19 13:23:55 -07:00
examples Embeddable examples on the platform and included with --run-examples flag (#52111) 2019-12-16 15:03:46 -05:00
licenses
packages Fix code coverage for functional tests (#53297) 2019-12-19 08:23:30 +01:00
rfcs [RFC][skip-ci] Prevent plugins from blocking Kibana startup (#45796) 2019-12-18 14:52:18 +01:00
scripts autofix all violations 2019-12-13 23:17:13 -07:00
src vis_type_timeseries server side new platform migration (#52501) 2019-12-19 18:51:06 +00:00
style_guides Updating accessibility guide and contributing readmes (#52038) 2019-12-04 19:11:16 -06:00
tasks Embeddable examples on the platform and included with --run-examples flag (#52111) 2019-12-16 15:03:46 -05:00
test [Dashboard] Fixing addVisualization func test (#53491) 2019-12-19 17:18:17 +00:00
typings Upgrade to EUI@17.1.2 [table typescript types] (#52688) 2019-12-18 11:15:14 -07:00
utilities autofix all violations 2019-12-13 23:17:13 -07:00
vars Print out agent debugging links during CI (#52812) 2019-12-12 10:58:18 -05:00
webpackShims autofix all violations 2019-12-13 23:17:13 -07:00
x-pack [SIEM][Detection Engine] Bulk REST API for create, update, and delete 2019-12-19 13:55:27 -07:00
.backportrc.json
.browserslistrc
.editorconfig
.eslintignore
.eslintrc.js ensure prettier overrides take precedence, remove style rules 2019-12-14 17:39:10 -07:00
.gitattributes
.gitignore Instrument Kibana with APM RUM agent (#44281) 2019-12-18 12:16:15 +01:00
.i18nrc.json move management registry to new platform (#53020) 2019-12-17 13:00:54 -06:00
.node-version Update Node.js to version 10.18.0 (#52865) 2019-12-18 13:07:14 +01:00
.nvmrc Update Node.js to version 10.18.0 (#52865) 2019-12-18 13:07:14 +01:00
.prettierrc
.sass-lint.yml
.yarnrc
CONTRIBUTING.md Add instructions for setting up remote clusters needed for CCS and CCR (#52796) 2019-12-11 16:38:15 -07:00
FAQ.md
github_checks_reporter.json
Gruntfile.js autofix all violations 2019-12-13 23:17:13 -07:00
Jenkinsfile Add PR comments to pipeline (#51504) 2019-12-03 18:06:30 -05:00
kibana.d.ts Update eslint related packages (#48513) 2019-10-21 16:32:31 -07:00
LICENSE.txt
NOTICE.txt remove remaining idx usage (#52354) 2019-12-09 15:59:07 -07:00
package.json Upgrade to EUI@17.1.2 [table typescript types] (#52688) 2019-12-18 11:15:14 -07:00
preinstall_check.js
README.md
renovate.json5 Update babel-typescript config (#53108) 2019-12-16 19:28:54 +01:00
STYLEGUIDE.md
tsconfig.browser.json
tsconfig.json
tsconfig.types.json
TYPESCRIPT.md
yarn.lock Shim input_control_vis for KP (#52243) 2019-12-18 16:25:35 -06:00

README.md

Kibana

Kibana is your window into the Elastic Stack. Specifically, it's a browser-based analytics and search dashboard for Elasticsearch.

Getting Started

If you just want to try Kibana out, check out the Elastic Stack Getting Started Page to give it a whirl.

If you're interested in diving a bit deeper and getting a taste of Kibana's capabilities, head over to the Kibana Getting Started Page.

Using a Kibana Release

If you want to use a Kibana release in production, give it a test run, or just play around:

Building and Running Kibana, and/or Contributing Code

You might want to build Kibana locally to contribute some code, test out the latest features, or try out an open PR:

Documentation

Visit Elastic.co for the full Kibana documentation.

For information about building the documentation, see the README in elastic/docs.

Version Compatibility with Elasticsearch

Ideally, you should be running Elasticsearch and Kibana with matching version numbers. If your Elasticsearch has an older version number or a newer major number than Kibana, then Kibana will fail to run. If Elasticsearch has a newer minor or patch number than Kibana, then the Kibana Server will log a warning.

Note: The version numbers below are only examples, meant to illustrate the relationships between different types of version numbers.

Situation Example Kibana version Example ES version Outcome
Versions are the same. 5.1.2 5.1.2 💚 OK
ES patch number is newer. 5.1.2 5.1.5 ⚠️ Logged warning
ES minor number is newer. 5.1.2 5.5.0 ⚠️ Logged warning
ES major number is newer. 5.1.2 6.0.0 🚫 Fatal error
ES patch number is older. 5.1.2 5.1.0 ⚠️ Logged warning
ES minor number is older. 5.1.2 5.0.0 🚫 Fatal error
ES major number is older. 5.1.2 4.0.0 🚫 Fatal error

Questions? Problems? Suggestions?

  • If you've found a bug or want to request a feature, please create a GitHub Issue. Please check to make sure someone else hasn't already created an issue for the same topic.
  • Need help using Kibana? Ask away on our Kibana Discuss Forum and a fellow community member or Elastic engineer will be glad to help you out.