No description
Find a file
Ryland Herrick 8b31ce0a89
[SIEM] Check ML Job status on ML Rule execution (#61715)
* Move isMlRule helper to a more general location

And use it during rule execution as well.

* Add error message back to rule error status

This was unintentionally removed in a previous merge commit.

* Expose mlClient as part of ML's Setup contract

This allows dependent plugins to leverage the exposed services without
having to define their own ml paths, e.g. "ml.jobs"

* Move ML Job predicates to common folder

These are pure functions and used on both the client and server.

* WIP: Check ML Job status on ML Rule execution

This works, but unfortunately it pushes this executor function to a
complexity of 25. We're gonna refactor this next.

* Move isMlRule and RuleType to common

These are used on both the frontend and the backend, and can be shared.

* Refactor Signal Rule executor to use RuleStatusService

RuleStatusService holds the logic for updating the current status as
well as adding an error status. It leverages a simple
RuleStatusSavedObjectClient to handle the communication with
SavedObjects.

This removes the need for our specialized 'writeError', 'writeGap', and
'writeSuccess' functions, which duplicated much of the rule status
logic and code. It also fixes a bug with gap failures, with should have
been treated the same as other failures.

NB that an error does not necessarily prevent the rule from running, as
in the case of a gap or an ML Job not running.

This also adds a buildRuleMessage helper to reduce the noise of
generating logs/messages, and to make them more consistent.

* Remove unneeded 'async' keywords

We're not awaiting here, so we can just return the promise.

* Make buildRuleStatusAttributes synchronous

We weren't doing anything async here, and in fact the returning of a
promise was causing a bug when we tried to spread it into our attributes
object.

* Fix incorrectly-named RuleStatus attributes

This mapping could be done within the ruleStatusService, but it
lives outside it for now.

Also renames the object holding these values to the more general
'result,' as creationSuccess implies it always succeeds.

* Move our rule message helpers to a separate file

Adds some tests, as well.

* Refactor how rule status objects interact

Only ruleStatusSavedObjectsClient receives a savedObjectsClient, the
other functions receive the ruleStatusSavedObjectsClient

* pluralizes savedObjects in ruleStatusSavedObjectsClient
* Backfills tests

* Handle adding multiple errors during a single rule execution

We were storing state in our RuleStatusClient, and consequently could
get into a situation where that state did not reflect reality, and we
would incorrectly try to delete a SavedObject that had already been
deleted.

Rather than try to store the _correct_ state in the service, we remove
state entirely and just fetch our statuses on each action.

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-03-30 16:35:38 -05:00
.ci
.github Migrate SO management routes to new plugin (#59734) 2020-03-26 12:43:54 +01:00
bin
common/graphql
config
data
docs Alerting user interface documentation and guide (#60256) 2020-03-27 16:45:24 -04:00
examples Add plugin start contract to getStartServices return value (#61216) 2020-03-26 10:49:05 +01:00
licenses
packages [plugin-generator] rewrite tests to match new generated plugins (#61571) 2020-03-27 10:54:54 -07:00
rfcs [skip-ci] Service Status RFC (#59621) 2020-03-16 09:23:58 -06:00
scripts The scripts/backport.js file isn't an executable (#59800) 2020-03-10 22:06:56 +01:00
src fix alias comparator (#61764) 2020-03-30 17:02:23 +03:00
tasks fix karma debug typo (#60029) 2020-03-12 13:13:58 -05:00
test Migrate test plugins ⇒ NP (kbn_tp_custom_visualizations) (#61606) 2020-03-30 18:24:02 +03:00
typings Upgrade EUI to 21.0.1 (#60282) 2020-03-20 14:07:04 -06:00
utilities
vars Only run xpack siem cypress in PRs when there are siem changes (#60661) 2020-03-23 10:30:14 -04:00
webpackShims
x-pack [SIEM] Check ML Job status on ML Rule execution (#61715) 2020-03-30 16:35:38 -05:00
.backportrc.json chore(na): add 7.7 branch to the list of branches to backport (#61240) 2020-03-25 07:21:27 -07:00
.browserslistrc
.editorconfig
.eslintignore
.eslintrc.js [plugin-generator] rewrite tests to match new generated plugins (#61571) 2020-03-27 10:54:54 -07:00
.gitattributes
.gitignore [APM] E2E: Zero config for running e2e locally (#59152) 2020-03-24 20:28:11 +01:00
.i18nrc.json move visualizations plugin to new platform (#60403) 2020-03-27 13:02:06 +01:00
.node-version
.nvmrc
.prettierrc
.sass-lint.yml License checks for actions plugin (#59070) 2020-03-20 10:49:37 -04:00
.yarnrc
api-documenter.json
CONTRIBUTING.md docs(NA): add node-gyp setup instructions to the contributing guide. (#60116) 2020-03-13 18:29:41 +00:00
FAQ.md
github_checks_reporter.json
Gruntfile.js
Jenkinsfile Only run xpack siem cypress in PRs when there are siem changes (#60661) 2020-03-23 10:30:14 -04:00
kibana.d.ts
LICENSE.txt
NOTICE.txt
package.json chore(NA): update es legacy client versions (#61477) 2020-03-27 16:25:09 +00:00
preinstall_check.js
README.md
renovate.json5 [Maps] convert layer utils to TS (#60791) 2020-03-24 09:38:00 -06:00
STYLEGUIDE.md
tsconfig.browser.json
tsconfig.json
tsconfig.types.json
TYPESCRIPT.md
yarn.lock Upgrade acorn (#61708) 2020-03-30 09:05:08 -04:00

Kibana

Kibana is your window into the Elastic Stack. Specifically, it's a browser-based analytics and search dashboard for Elasticsearch.

Getting Started

If you just want to try Kibana out, check out the Elastic Stack Getting Started Page to give it a whirl.

If you're interested in diving a bit deeper and getting a taste of Kibana's capabilities, head over to the Kibana Getting Started Page.

Using a Kibana Release

If you want to use a Kibana release in production, give it a test run, or just play around:

Building and Running Kibana, and/or Contributing Code

You might want to build Kibana locally to contribute some code, test out the latest features, or try out an open PR:

Documentation

Visit Elastic.co for the full Kibana documentation.

For information about building the documentation, see the README in elastic/docs.

Version Compatibility with Elasticsearch

Ideally, you should be running Elasticsearch and Kibana with matching version numbers. If your Elasticsearch has an older version number or a newer major number than Kibana, then Kibana will fail to run. If Elasticsearch has a newer minor or patch number than Kibana, then the Kibana Server will log a warning.

Note: The version numbers below are only examples, meant to illustrate the relationships between different types of version numbers.

Situation Example Kibana version Example ES version Outcome
Versions are the same. 5.1.2 5.1.2 💚 OK
ES patch number is newer. 5.1.2 5.1.5 ⚠️ Logged warning
ES minor number is newer. 5.1.2 5.5.0 ⚠️ Logged warning
ES major number is newer. 5.1.2 6.0.0 🚫 Fatal error
ES patch number is older. 5.1.2 5.1.0 ⚠️ Logged warning
ES minor number is older. 5.1.2 5.0.0 🚫 Fatal error
ES major number is older. 5.1.2 4.0.0 🚫 Fatal error

Questions? Problems? Suggestions?

  • If you've found a bug or want to request a feature, please create a GitHub Issue. Please check to make sure someone else hasn't already created an issue for the same topic.
  • Need help using Kibana? Ask away on our Kibana Discuss Forum and a fellow community member or Elastic engineer will be glad to help you out.