diff --git a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_fired.ts b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_fired.ts deleted file mode 100644 index dc6197320ecf0..0000000000000 --- a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/avg_pct_fired.ts +++ /dev/null @@ -1,271 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import { omit } from 'lodash'; -import { cleanup, generate, Dataset, PartialConfig } from '@kbn/data-forge'; -import { Aggregators } from '@kbn/observability-plugin/common/custom_threshold_rule/types'; -import { FIRED_ACTIONS_ID } from '@kbn/observability-plugin/server/lib/rules/custom_threshold/constants'; -import expect from '@kbn/expect'; -import { OBSERVABILITY_THRESHOLD_RULE_TYPE_ID } from '@kbn/rule-data-utils'; -import { parseSearchParams } from '@kbn/share-plugin/common/url_service'; -import { COMPARATORS } from '@kbn/alerting-comparators'; -import { createIndexConnector, createRule } from '../helpers/alerting_api_helper'; -import { - waitForAlertInIndex, - waitForDocumentInIndex, - waitForRuleStatus, -} from '../helpers/alerting_wait_for_helpers'; -import { FtrProviderContext } from '../../common/ftr_provider_context'; -import { ActionDocument, LogsExplorerLocatorParsedParams } from './typings'; -import { ISO_DATE_REGEX } from './constants'; - -// eslint-disable-next-line import/no-default-export -export default function ({ getService }: FtrProviderContext) { - const esClient = getService('es'); - const supertest = getService('supertest'); - const esDeleteAllIndices = getService('esDeleteAllIndices'); - const logger = getService('log'); - const retryService = getService('retry'); - - describe('Custom Threshold rule - AVG - PCT - FIRED', () => { - const CUSTOM_THRESHOLD_RULE_ALERT_INDEX = '.alerts-observability.threshold.alerts-default'; - const ALERT_ACTION_INDEX = 'alert-action-threshold'; - const DATA_VIEW_TITLE = 'kbn-data-forge-fake_hosts.fake_hosts-*'; - const DATA_VIEW_NAME = 'ad-hoc-data-view-name'; - const DATA_VIEW_ID = 'data-view-id'; - const MOCKED_AD_HOC_DATA_VIEW = { - id: DATA_VIEW_ID, - title: DATA_VIEW_TITLE, - timeFieldName: '@timestamp', - sourceFilters: [], - fieldFormats: {}, - runtimeFieldMap: {}, - allowNoIndex: false, - name: DATA_VIEW_NAME, - allowHidden: false, - }; - let dataForgeConfig: PartialConfig; - let dataForgeIndices: string[]; - let actionId: string; - let ruleId: string; - let alertId: string; - - before(async () => { - dataForgeConfig = { - schedule: [ - { - template: 'good', - start: 'now-10m', - end: 'now+5m', - metrics: [ - { name: 'system.cpu.user.pct', method: 'linear', start: 2.5, end: 2.5 }, - { name: 'system.cpu.total.pct', method: 'linear', start: 0.5, end: 0.5 }, - ], - }, - ], - indexing: { - dataset: 'fake_hosts' as Dataset, - eventsPerCycle: 1, - interval: 10000, - alignEventsToInterval: true, - }, - }; - dataForgeIndices = await generate({ client: esClient, config: dataForgeConfig, logger }); - logger.info(JSON.stringify(dataForgeIndices.join(','))); - await waitForDocumentInIndex({ - esClient, - indexName: DATA_VIEW_TITLE, - docCountTarget: 270, - retryService, - logger, - }); - }); - - after(async () => { - await supertest.delete(`/api/alerting/rule/${ruleId}`).set('kbn-xsrf', 'foo'); - await supertest.delete(`/api/actions/connector/${actionId}`).set('kbn-xsrf', 'foo'); - await esClient.deleteByQuery({ - index: CUSTOM_THRESHOLD_RULE_ALERT_INDEX, - query: { term: { 'kibana.alert.rule.uuid': ruleId } }, - }); - await esClient.deleteByQuery({ - index: '.kibana-event-log-*', - query: { term: { 'kibana.alert.rule.consumer': 'logs' } }, - }); - await esDeleteAllIndices([ALERT_ACTION_INDEX, ...dataForgeIndices]); - await cleanup({ client: esClient, config: dataForgeConfig, logger }); - }); - - describe('Rule creation', () => { - it('creates rule successfully', async () => { - actionId = await createIndexConnector({ - supertest, - name: 'Index Connector: Threshold API test', - indexName: ALERT_ACTION_INDEX, - logger, - }); - - const createdRule = await createRule({ - supertest, - logger, - esClient, - tags: ['observability'], - consumer: 'logs', - name: 'Threshold rule', - ruleTypeId: OBSERVABILITY_THRESHOLD_RULE_TYPE_ID, - params: { - criteria: [ - { - comparator: COMPARATORS.GREATER_THAN, - threshold: [0.5], - timeSize: 5, - timeUnit: 'm', - metrics: [ - { name: 'A', field: 'system.cpu.user.pct', aggType: Aggregators.AVERAGE }, - ], - }, - ], - alertOnNoData: true, - alertOnGroupDisappear: true, - searchConfiguration: { - query: { - query: '', - language: 'kuery', - }, - index: MOCKED_AD_HOC_DATA_VIEW, - }, - }, - actions: [ - { - group: FIRED_ACTIONS_ID, - id: actionId, - params: { - documents: [ - { - ruleType: '{{rule.type}}', - alertDetailsUrl: '{{context.alertDetailsUrl}}', - reason: '{{context.reason}}', - value: '{{context.value}}', - host: '{{context.host}}', - viewInAppUrl: '{{context.viewInAppUrl}}', - }, - ], - }, - frequency: { - notify_when: 'onActionGroupChange', - throttle: null, - summary: false, - }, - }, - ], - }); - ruleId = createdRule.id; - expect(ruleId).not.to.be(undefined); - }); - - it('should be active', async () => { - const executionStatus = await waitForRuleStatus({ - id: ruleId, - expectedStatus: 'active', - supertest, - retryService, - logger, - }); - expect(executionStatus.status).to.be('active'); - }); - - it('should set correct information in the alert document', async () => { - const resp = await waitForAlertInIndex({ - esClient, - indexName: CUSTOM_THRESHOLD_RULE_ALERT_INDEX, - ruleId, - retryService, - logger, - }); - alertId = (resp.hits.hits[0]._source as any)['kibana.alert.uuid']; - - expect(resp.hits.hits[0]._source).property( - 'kibana.alert.rule.category', - 'Custom threshold' - ); - expect(resp.hits.hits[0]._source).property('kibana.alert.rule.consumer', 'logs'); - expect(resp.hits.hits[0]._source).property('kibana.alert.rule.name', 'Threshold rule'); - expect(resp.hits.hits[0]._source).property('kibana.alert.rule.producer', 'observability'); - expect(resp.hits.hits[0]._source).property('kibana.alert.rule.revision', 0); - expect(resp.hits.hits[0]._source).property( - 'kibana.alert.rule.rule_type_id', - 'observability.rules.custom_threshold' - ); - expect(resp.hits.hits[0]._source).property('kibana.alert.rule.uuid', ruleId); - expect(resp.hits.hits[0]._source).property('kibana.space_ids').contain('default'); - expect(resp.hits.hits[0]._source) - .property('kibana.alert.rule.tags') - .contain('observability'); - expect(resp.hits.hits[0]._source).property( - 'kibana.alert.action_group', - 'custom_threshold.fired' - ); - expect(resp.hits.hits[0]._source).property('tags').contain('observability'); - expect(resp.hits.hits[0]._source).property('kibana.alert.instance.id', '*'); - expect(resp.hits.hits[0]._source).property('kibana.alert.workflow_status', 'open'); - expect(resp.hits.hits[0]._source).property('event.kind', 'signal'); - expect(resp.hits.hits[0]._source).property('event.action', 'open'); - expect(resp.hits.hits[0]._source).property('kibana.alert.evaluation.threshold').eql([0.5]); - expect(resp.hits.hits[0]._source) - .property('kibana.alert.rule.parameters') - .eql({ - criteria: [ - { - comparator: '>', - threshold: [0.5], - timeSize: 5, - timeUnit: 'm', - metrics: [{ name: 'A', field: 'system.cpu.user.pct', aggType: 'avg' }], - }, - ], - alertOnNoData: true, - alertOnGroupDisappear: true, - searchConfiguration: { - index: MOCKED_AD_HOC_DATA_VIEW, - query: { query: '', language: 'kuery' }, - }, - }); - }); - - it('should set correct action variables', async () => { - const resp = await waitForDocumentInIndex({ - esClient, - indexName: ALERT_ACTION_INDEX, - retryService, - logger, - }); - - expect(resp.hits.hits[0]._source?.ruleType).eql('observability.rules.custom_threshold'); - expect(resp.hits.hits[0]._source?.alertDetailsUrl).eql( - `https://localhost:5601/app/observability/alerts/${alertId}` - ); - expect(resp.hits.hits[0]._source?.reason).eql( - `Average system.cpu.user.pct is 250%, above the threshold of 50%. (duration: 5 mins, data view: ${DATA_VIEW_NAME})` - ); - expect(resp.hits.hits[0]._source?.value).eql('250%'); - - const parsedViewInAppUrl = parseSearchParams( - new URL(resp.hits.hits[0]._source?.viewInAppUrl || '').search - ); - - expect(resp.hits.hits[0]._source?.viewInAppUrl).contain('LOGS_EXPLORER_LOCATOR'); - expect(omit(parsedViewInAppUrl.params, 'timeRange.from')).eql({ - dataset: DATA_VIEW_TITLE, - timeRange: { to: 'now' }, - query: { query: '', language: 'kuery' }, - filters: [], - }); - expect(parsedViewInAppUrl.params.timeRange.from).match(ISO_DATE_REGEX); - }); - }); - }); -} diff --git a/x-pack/test/alerting_api_integration/observability/index.ts b/x-pack/test/alerting_api_integration/observability/index.ts index 547c05a46bfcd..8b2f7b5b4c20e 100644 --- a/x-pack/test/alerting_api_integration/observability/index.ts +++ b/x-pack/test/alerting_api_integration/observability/index.ts @@ -10,7 +10,6 @@ export default function ({ loadTestFile }: any) { describe('Observability Rules', () => { describe('Rules Endpoints', () => { loadTestFile(require.resolve('./metric_threshold_rule')); - loadTestFile(require.resolve('./custom_threshold_rule/avg_pct_fired')); loadTestFile(require.resolve('./custom_threshold_rule/p99_pct_fired')); loadTestFile(require.resolve('./custom_threshold_rule/rate_bytes_fired')); loadTestFile(require.resolve('./custom_threshold_rule/avg_pct_no_data')); diff --git a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_fired.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/avg_pct_fired.ts similarity index 88% rename from x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_fired.ts rename to x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/avg_pct_fired.ts index 358fabd7956ef..63530c98c26df 100644 --- a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/avg_pct_fired.ts +++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/avg_pct_fired.ts @@ -5,33 +5,35 @@ * 2.0. */ +import expect from '@kbn/expect'; +import { omit } from 'lodash'; import { cleanup, generate, Dataset, PartialConfig } from '@kbn/data-forge'; import { Aggregators } from '@kbn/observability-plugin/common/custom_threshold_rule/types'; import { FIRED_ACTIONS_ID } from '@kbn/observability-plugin/server/lib/rules/custom_threshold/constants'; -import expect from '@kbn/expect'; import { OBSERVABILITY_THRESHOLD_RULE_TYPE_ID } from '@kbn/rule-data-utils'; import { parseSearchParams } from '@kbn/share-plugin/common/url_service'; -import { omit } from 'lodash'; import { COMPARATORS } from '@kbn/alerting-comparators'; import { kbnTestConfig } from '@kbn/test'; -import { FtrProviderContext } from '../../../ftr_provider_context'; +import type { InternalRequestHeader, RoleCredentials } from '@kbn/ftr-common-functional-services'; +import { DeploymentAgnosticFtrProviderContext } from '../../../../ftr_provider_context'; import { ISO_DATE_REGEX } from './constants'; -import { ActionDocument, LogsExplorerLocatorParsedParams } from './typings'; -import type { InternalRequestHeader, RoleCredentials } from '../../../../shared/services'; +import { ActionDocument, LogsExplorerLocatorParsedParams } from './types'; -export default function ({ getService }: FtrProviderContext) { +export default function ({ getService }: DeploymentAgnosticFtrProviderContext) { const esClient = getService('es'); - const supertest = getService('supertest'); + const samlAuth = getService('samlAuth'); + const supertestWithoutAuth = getService('supertestWithoutAuth'); const esDeleteAllIndices = getService('esDeleteAllIndices'); const alertingApi = getService('alertingApi'); const dataViewApi = getService('dataViewApi'); const logger = getService('log'); - const svlCommonApi = getService('svlCommonApi'); - const svlUserManager = getService('svlUserManager'); let roleAuthc: RoleCredentials; let internalReqHeader: InternalRequestHeader; + const config = getService('config'); + const isServerless = config.get('serverless'); + const expectedConsumer = isServerless ? 'observability' : 'logs'; - describe('Custom Threshold rule - AVG - PCT - FIRED', () => { + describe('AVG - PCT - FIRED', () => { const CUSTOM_THRESHOLD_RULE_ALERT_INDEX = '.alerts-observability.threshold.alerts-default'; const ALERT_ACTION_INDEX = 'alert-action-threshold'; const DATA_VIEW_TITLE = 'kbn-data-forge-fake_hosts.fake_hosts-*'; @@ -44,8 +46,8 @@ export default function ({ getService }: FtrProviderContext) { let alertId: string; before(async () => { - roleAuthc = await svlUserManager.createM2mApiKeyWithRoleScope('admin'); - internalReqHeader = svlCommonApi.getInternalRequestHeader(); + roleAuthc = await samlAuth.createM2mApiKeyWithRoleScope('admin'); + internalReqHeader = samlAuth.getInternalRequestHeader(); dataForgeConfig = { schedule: [ { @@ -71,12 +73,19 @@ export default function ({ getService }: FtrProviderContext) { name: DATA_VIEW_NAME, id: DATA_VIEW_ID, title: DATA_VIEW_TITLE, + roleAuthc, }); }); after(async () => { - await supertest.delete(`/api/alerting/rule/${ruleId}`).set(internalReqHeader); - await supertest.delete(`/api/actions/connector/${actionId}`).set(internalReqHeader); + await supertestWithoutAuth + .delete(`/api/alerting/rule/${ruleId}`) + .set(roleAuthc.apiKeyHeader) + .set(internalReqHeader); + await supertestWithoutAuth + .delete(`/api/actions/connector/${actionId}`) + .set(roleAuthc.apiKeyHeader) + .set(internalReqHeader); await esClient.deleteByQuery({ index: CUSTOM_THRESHOLD_RULE_ALERT_INDEX, query: { term: { 'kibana.alert.rule.uuid': ruleId } }, @@ -89,10 +98,11 @@ export default function ({ getService }: FtrProviderContext) { }); await dataViewApi.delete({ id: DATA_VIEW_ID, + roleAuthc, }); await esDeleteAllIndices([ALERT_ACTION_INDEX, ...dataForgeIndices]); await cleanup({ client: esClient, config: dataForgeConfig, logger }); - await svlUserManager.invalidateM2mApiKeyWithRoleScope(roleAuthc); + await samlAuth.invalidateM2mApiKeyWithRoleScope(roleAuthc); }); describe('Rule creation', () => { @@ -106,7 +116,7 @@ export default function ({ getService }: FtrProviderContext) { const createdRule = await alertingApi.createRule({ roleAuthc, tags: ['observability'], - consumer: 'observability', + consumer: expectedConsumer, name: 'Threshold rule', ruleTypeId: OBSERVABILITY_THRESHOLD_RULE_TYPE_ID, params: { @@ -171,7 +181,7 @@ export default function ({ getService }: FtrProviderContext) { it('should find the created rule with correct information about the consumer', async () => { const match = await alertingApi.findInRules(roleAuthc, ruleId); expect(match).not.to.be(undefined); - expect(match.consumer).to.be('observability'); + expect(match.consumer).to.be(expectedConsumer); }); it('should set correct information in the alert document', async () => { @@ -185,7 +195,7 @@ export default function ({ getService }: FtrProviderContext) { 'kibana.alert.rule.category', 'Custom threshold' ); - expect(resp.hits.hits[0]._source).property('kibana.alert.rule.consumer', 'observability'); + expect(resp.hits.hits[0]._source).property('kibana.alert.rule.consumer', expectedConsumer); expect(resp.hits.hits[0]._source).property('kibana.alert.rule.name', 'Threshold rule'); expect(resp.hits.hits[0]._source).property('kibana.alert.rule.producer', 'observability'); expect(resp.hits.hits[0]._source).property('kibana.alert.rule.revision', 0); @@ -232,7 +242,7 @@ export default function ({ getService }: FtrProviderContext) { docCountTarget: 1, }); - const { protocol, hostname, port } = kbnTestConfig.getUrlParts(); + const { protocol, hostname, port } = kbnTestConfig.getUrlPartsWithStrippedDefaultPort(); expect(resp.hits.hits[0]._source?.ruleType).eql('observability.rules.custom_threshold'); expect(resp.hits.hits[0]._source?.alertDetailsUrl).eql( `${protocol}://${hostname}${port ? `:${port}` : ''}/app/observability/alerts/${alertId}` diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/constants.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/constants.ts new file mode 100644 index 0000000000000..5cf1e0b4d6614 --- /dev/null +++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/constants.ts @@ -0,0 +1,8 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +export const ISO_DATE_REGEX = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/; diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/index.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/index.ts new file mode 100644 index 0000000000000..505cbba20eb7c --- /dev/null +++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/index.ts @@ -0,0 +1,14 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { DeploymentAgnosticFtrProviderContext } from '../../../../ftr_provider_context'; + +export default function ({ loadTestFile }: DeploymentAgnosticFtrProviderContext) { + describe('Custom Threshold rule', () => { + loadTestFile(require.resolve('./avg_pct_fired')); + }); +} diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/types.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/types.ts new file mode 100644 index 0000000000000..9002e9991292f --- /dev/null +++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/custom_threshold/types.ts @@ -0,0 +1,25 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { Query, TimeRange } from '@kbn/es-query'; +import { SerializableRecord } from '@kbn/utility-types'; + +export interface ActionDocument { + ruleType: string; + alertDetailsUrl: string; + reason: string; + value: string; + viewInAppUrl: string; + host?: string; + group?: string; +} + +export interface LogsExplorerLocatorParsedParams extends SerializableRecord { + dataset: string; + timeRange: TimeRange; + query: Query; +} diff --git a/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/index.ts b/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/index.ts index 9fa2f0531d325..e425aa1010a6d 100644 --- a/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/index.ts +++ b/x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/index.ts @@ -11,5 +11,6 @@ export default function ({ loadTestFile }: DeploymentAgnosticFtrProviderContext) describe('Observability Alerting', () => { loadTestFile(require.resolve('./burn_rate_rule')); loadTestFile(require.resolve('./es_query_rule')); + loadTestFile(require.resolve('./custom_threshold')); }); } diff --git a/x-pack/test/api_integration/deployment_agnostic/services/data_view_api.ts b/x-pack/test/api_integration/deployment_agnostic/services/data_view_api.ts index c22db40882b60..33e829d8c9e39 100644 --- a/x-pack/test/api_integration/deployment_agnostic/services/data_view_api.ts +++ b/x-pack/test/api_integration/deployment_agnostic/services/data_view_api.ts @@ -50,7 +50,7 @@ export function DataViewApiProvider({ getService }: DeploymentAgnosticFtrProvide async delete({ roleAuthc, id }: { roleAuthc: RoleCredentials; id: string }) { const { body } = await supertestWithoutAuth - .post(`/api/content_management/rpc/create`) + .post(`/api/content_management/rpc/delete`) .set(roleAuthc.apiKeyHeader) .set(samlAuth.getInternalRequestHeader()) .set(samlAuth.getCommonRequestHeader()) diff --git a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/index.ts b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/index.ts index e8246cbe79809..01e91f1d5840b 100644 --- a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/index.ts +++ b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/index.ts @@ -9,7 +9,6 @@ import { FtrProviderContext } from '../../../ftr_provider_context'; export default function ({ loadTestFile }: FtrProviderContext) { describe('Custom Threshold Rule', function () { - loadTestFile(require.resolve('./avg_pct_fired')); loadTestFile(require.resolve('./avg_pct_no_data')); loadTestFile(require.resolve('./documents_count_fired')); loadTestFile(require.resolve('./custom_eq_avg_bytes_fired'));