[AO] Update default action and recovery messages for observability ru…

…le types (#159571) Closes #157284, closes #158437 ## Summary This PR updates the default action and recovery message for observability rule types. Only uptime is excluded in this PR, I will add that after synching with the synthetics team. [Here](https://docs.google.com/spreadsheets/d/15cJanv0xi4EKo1QZVXsi_NcFcPa_VQze3nQc4P8GZrQ/edit?pli=1#gid=0) you can find the list of default messages and the new proposals. ![image](https://github.com/elastic/kibana/assets/12370520/4f36e971-d8c2-47a9-ac25-9cae567db774) ## 🧪 How to test - Ensure that `server.publicBaseUrl` is configured in kibana.dev.yml - Create an observability rule with an action such as Email to use the default messages (both for alert and recover states) - After an alert is triggered, check the generated action message, it should - match the message mentioned in the list - contain an alert details link pointing to the Alerts page filtered for that specific alert --------- Co-authored-by: kibanamachine <[email protected]>
elastic · Jun 14, 2023 · 807c5d9 · 807c5d9
1 parent b78c798
commit 807c5d9
Show file tree

Hide file tree

Showing 18 changed files with 252 additions and 77 deletions.
diff --git a/packages/kbn-optimizer/limits.yml b/packages/kbn-optimizer/limits.yml
@@ -95,7 +95,7 @@ pageLoadAssetSize:
   monitoring: 80000
   navigation: 37269
   newsfeed: 42228
-  observability: 105500
+  observability: 115443
   observabilityOnboarding: 19573
   observabilityShared: 52256
   osquery: 107090

diff --git a/x-pack/plugins/apm/common/rules/default_action_message.ts b/x-pack/plugins/apm/common/rules/default_action_message.ts
@@ -10,52 +10,139 @@ import { i18n } from '@kbn/i18n';
 export const errorCountMessage = i18n.translate(
   'xpack.apm.alertTypes.errorCount.defaultActionMessage',
   {
-    defaultMessage: `\\{\\{alertName\\}\\} alert is firing because of the following conditions:
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} is active with the following conditions:
 
 - Service name: \\{\\{context.serviceName\\}\\}
 - Environment: \\{\\{context.environment\\}\\}
+- Error count: \\{\\{context.triggerValue\\}\\} errors over the last \\{\\{context.interval\\}\\}
 - Threshold: \\{\\{context.threshold\\}\\}
-- Triggered value: \\{\\{context.triggerValue\\}\\} errors over the last \\{\\{context.interval\\}\\}`,
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
+  }
+);
+export const errorCountRecoveryMessage = i18n.translate(
+  'xpack.apm.alertTypes.errorCount.defaultRecoveryMessage',
+  {
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} has recovered.
+
+- Service name: \\{\\{context.serviceName\\}\\}
+- Environment: \\{\\{context.environment\\}\\}
+- Error count: \\{\\{context.triggerValue\\}\\} errors over the last \\{\\{context.interval\\}\\}
+- Threshold: \\{\\{context.threshold\\}\\}
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
   }
 );
 
 export const transactionDurationMessage = i18n.translate(
   'xpack.apm.alertTypes.transactionDuration.defaultActionMessage',
   {
-    defaultMessage: `\\{\\{alertName\\}\\} alert is firing because of the following conditions:
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} is active with the following conditions:
 
 - Service name: \\{\\{context.serviceName\\}\\}
 - Transaction type: \\{\\{context.transactionType\\}\\}
 - Transaction name: \\{\\{context.transactionName\\}\\}
 - Environment: \\{\\{context.environment\\}\\}
-- Latency threshold: \\{\\{context.threshold\\}\\}ms
-- Latency observed: \\{\\{context.triggerValue\\}\\} over the last \\{\\{context.interval\\}\\}`,
+- Latency: \\{\\{context.triggerValue\\}\\} over the last \\{\\{context.interval\\}\\}
+- Threshold: \\{\\{context.threshold\\}\\}ms
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
+  }
+);
+export const transactionDurationRecoveryMessage = i18n.translate(
+  'xpack.apm.alertTypes.transactionDuration.defaultRecoveryMessage',
+  {
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} has recovered.
+
+- Service name: \\{\\{context.serviceName\\}\\}
+- Transaction type: \\{\\{context.transactionType\\}\\}
+- Transaction name: \\{\\{context.transactionName\\}\\}
+- Environment: \\{\\{context.environment\\}\\}
+- Latency: \\{\\{context.triggerValue\\}\\} over the last \\{\\{context.interval\\}\\}
+- Threshold: \\{\\{context.threshold\\}\\}ms
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
   }
 );
 
 export const transactionErrorRateMessage = i18n.translate(
   'xpack.apm.alertTypes.transactionErrorRate.defaultActionMessage',
   {
-    defaultMessage: `\\{\\{alertName\\}\\} alert is firing because of the following conditions:
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} is active with the following conditions:
 
 - Service name: \\{\\{context.serviceName\\}\\}
-- Type: \\{\\{context.transactionType\\}\\}
+- Transaction type: \\{\\{context.transactionType\\}\\}
 - Environment: \\{\\{context.environment\\}\\}
+- Failed transaction rate: \\{\\{context.triggerValue\\}\\}% of errors over the last \\{\\{context.interval\\}\\}
 - Threshold: \\{\\{context.threshold\\}\\}%
-- Triggered value: \\{\\{context.triggerValue\\}\\}% of errors over the last \\{\\{context.interval\\}\\}`,
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
+  }
+);
+export const transactionErrorRateRecoveryMessage = i18n.translate(
+  'xpack.apm.alertTypes.transactionErrorRate.defaultRecoveryMessage',
+  {
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} has recovered.
+
+- Service name: \\{\\{context.serviceName\\}\\}
+- Transaction type: \\{\\{context.transactionType\\}\\}
+- Environment: \\{\\{context.environment\\}\\}
+- Failed transaction rate: \\{\\{context.triggerValue\\}\\}% of errors over the last \\{\\{context.interval\\}\\}
+- Threshold: \\{\\{context.threshold\\}\\}%
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
   }
 );
 
 export const anomalyMessage = i18n.translate(
   'xpack.apm.alertTypes.transactionDurationAnomaly.defaultActionMessage',
   {
-    defaultMessage: `\\{\\{alertName\\}\\} alert is firing because of the following conditions:
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} is active with the following conditions:
+
+- Service name: \\{\\{context.serviceName\\}\\}
+- Transaction type: \\{\\{context.transactionType\\}\\}
+- Environment: \\{\\{context.environment\\}\\}
+- Severity: \\{\\{context.triggerValue\\}\\}
+- Threshold: \\{\\{context.threshold\\}\\}
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
+  }
+);
+export const anomalyRecoveryMessage = i18n.translate(
+  'xpack.apm.alertTypes.transactionDurationAnomaly.defaultRecoveryMessage',
+  {
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} has recovered.
 
 - Service name: \\{\\{context.serviceName\\}\\}
-- Type: \\{\\{context.transactionType\\}\\}
+- Transaction type: \\{\\{context.transactionType\\}\\}
 - Environment: \\{\\{context.environment\\}\\}
-- Severity threshold: \\{\\{context.threshold\\}\\}
-- Severity value: \\{\\{context.triggerValue\\}\\}
+- Severity: \\{\\{context.triggerValue\\}\\}
+- Threshold: \\{\\{context.threshold\\}\\}
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
 `,
   }
 );
diff --git a/x-pack/plugins/apm/public/components/alerting/rule_types/register_apm_rule_types.ts b/x-pack/plugins/apm/public/components/alerting/rule_types/register_apm_rule_types.ts
@@ -16,9 +16,13 @@ import {
 import { ApmRuleType } from '../../../../common/rules/apm_rule_types';
 import {
   anomalyMessage,
+  anomalyRecoveryMessage,
   errorCountMessage,
+  errorCountRecoveryMessage,
   transactionDurationMessage,
+  transactionDurationRecoveryMessage,
   transactionErrorRateMessage,
+  transactionErrorRateRecoveryMessage,
 } from '../../../../common/rules/default_action_message';
 
 // copied from elasticsearch_fieldnames.ts to limit page load bundle size
@@ -55,6 +59,7 @@ export function registerApmRuleTypes(
     }),
     requiresAppContext: false,
     defaultActionMessage: errorCountMessage,
+    defaultRecoveryMessage: errorCountRecoveryMessage,
   });
 
   observabilityRuleTypeRegistry.register({
@@ -92,6 +97,7 @@ export function registerApmRuleTypes(
     ),
     requiresAppContext: false,
     defaultActionMessage: transactionDurationMessage,
+    defaultRecoveryMessage: transactionDurationRecoveryMessage,
   });
 
   observabilityRuleTypeRegistry.register({
@@ -124,6 +130,7 @@ export function registerApmRuleTypes(
     }),
     requiresAppContext: false,
     defaultActionMessage: transactionErrorRateMessage,
+    defaultRecoveryMessage: transactionErrorRateRecoveryMessage,
   });
 
   observabilityRuleTypeRegistry.register({
@@ -153,5 +160,6 @@ export function registerApmRuleTypes(
     }),
     requiresAppContext: false,
     defaultActionMessage: anomalyMessage,
+    defaultRecoveryMessage: anomalyRecoveryMessage,
   });
 }
diff --git a/x-pack/plugins/apm/server/routes/alerts/action_variables.ts b/x-pack/plugins/apm/server/routes/alerts/action_variables.ts
@@ -13,7 +13,7 @@ export const apmActionVariables = {
       'xpack.apm.alerts.action_variables.alertDetailsUrl',
       {
         defaultMessage:
-          'Link to the view within Elastic that shows further details and context surrounding this alert',
+          'Link to the alert troubleshooting view for further context and details. This will be an empty string if the server.publicBaseUrl is not configured.',
       }
     ),
     name: 'alertDetailsUrl' as const,
@@ -87,8 +87,7 @@ export const apmActionVariables = {
     description: i18n.translate(
       'xpack.apm.alerts.action_variables.viewInAppUrl',
       {
-        defaultMessage:
-          'Link to the view or feature within Elastic that can be used to investigate the alert and its context further',
+        defaultMessage: 'Link to the alert source',
       }
     ),
     name: 'viewInAppUrl' as const,

diff --git a/x-pack/plugins/infra/public/alerting/inventory/index.ts b/x-pack/plugins/infra/public/alerting/inventory/index.ts
@@ -20,6 +20,36 @@ interface InventoryMetricRuleTypeParams extends RuleTypeParams {
   criteria: InventoryMetricConditions[];
 }
 
+const inventoryDefaultActionMessage = i18n.translate(
+  'xpack.infra.metrics.alerting.inventory.threshold.defaultActionMessage',
+  {
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} is active with the following conditions:
+
+- Affected: \\{\\{context.group\\}\\}
+- Metric: \\{\\{context.metric\\}\\}
+- Observed value: \\{\\{context.value\\}\\}
+- Threshold: \\{\\{context.threshold\\}\\}
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
+  }
+);
+const inventoryDefaultRecoveryMessage = i18n.translate(
+  'xpack.infra.metrics.alerting.inventory.threshold.defaultRecoveryMessage',
+  {
+    defaultMessage: `\\{\\{rule.name\\}\\} has recovered.
+
+- Affected: \\{\\{context.group\\}\\}
+- Metric: \\{\\{context.metric\\}\\}
+- Threshold: \\{\\{context.threshold\\}\\}
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
+  }
+);
+
 export function createInventoryMetricRuleType(): ObservabilityRuleTypeModel<InventoryMetricRuleTypeParams> {
   return {
     id: METRIC_INVENTORY_THRESHOLD_ALERT_TYPE_ID,
@@ -32,16 +62,8 @@ export function createInventoryMetricRuleType(): ObservabilityRuleTypeModel<Inve
     },
     ruleParamsExpression: React.lazy(() => import('./components/expression')),
     validate: validateMetricThreshold,
-    defaultActionMessage: i18n.translate(
-      'xpack.infra.metrics.alerting.inventory.threshold.defaultActionMessage',
-      {
-        defaultMessage: `\\{\\{alertName\\}\\} - \\{\\{context.group\\}\\} is in a state of \\{\\{context.alertState\\}\\}
-
-Reason:
-\\{\\{context.reason\\}\\}
-`,
-      }
-    ),
+    defaultActionMessage: inventoryDefaultActionMessage,
+    defaultRecoveryMessage: inventoryDefaultRecoveryMessage,
     requiresAppContext: false,
     format: formatReason,
   };

diff --git a/x-pack/plugins/infra/public/alerting/log_threshold/log_threshold_rule_type.tsx b/x-pack/plugins/infra/public/alerting/log_threshold/log_threshold_rule_type.tsx
@@ -18,6 +18,30 @@ import { InfraClientCoreSetup } from '../../types';
 import { createRuleFormatter } from './rule_data_formatters';
 import { validateExpression } from './validation';
 
+const logThresholdDefaultActionMessage = i18n.translate(
+  'xpack.infra.logs.alerting.threshold.defaultActionMessage',
+  {
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} is active.
+
+\\{\\{^context.isRatio\\}\\}\\{\\{#context.group\\}\\}\\{\\{context.group\\}\\} - \\{\\{/context.group\\}\\}\\{\\{context.matchingDocuments\\}\\} log entries have matched the following conditions: \\{\\{context.conditions\\}\\}\\{\\{/context.isRatio\\}\\}
+\\{\\{#context.isRatio\\}\\}\\{\\{#context.group\\}\\}\\{\\{context.group\\}\\} - \\{\\{/context.group\\}\\} Ratio of the count of log entries matching \\{\\{context.numeratorConditions\\}\\} to the count of log entries matching \\{\\{context.denominatorConditions\\}\\} was \\{\\{context.ratio\\}\\}\\{\\{/context.isRatio\\}\\}
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
+  }
+);
+const logThresholdDefaultRecoveryMessage = i18n.translate(
+  'xpack.infra.logs.alerting.threshold.defaultRecoveryMessage',
+  {
+    defaultMessage: `\\{\\{rule.name\\}\\} has recovered.
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
+  }
+);
+
 export function createLogThresholdRuleType(
   core: InfraClientCoreSetup,
   logsLocator: LocatorPublic<LogsLocatorParams>
@@ -44,12 +68,8 @@ export function createLogThresholdRuleType(
     alertDetailsAppSection,
     ruleParamsExpression,
     validate: validateExpression,
-    defaultActionMessage: i18n.translate(
-      'xpack.infra.logs.alerting.threshold.defaultActionMessage',
-      {
-        defaultMessage: `\\{\\{^context.isRatio\\}\\}\\{\\{#context.group\\}\\}\\{\\{context.group\\}\\} - \\{\\{/context.group\\}\\}\\{\\{context.matchingDocuments\\}\\} log entries have matched the following conditions: \\{\\{context.conditions\\}\\}\\{\\{/context.isRatio\\}\\}\\{\\{#context.isRatio\\}\\}\\{\\{#context.group\\}\\}\\{\\{context.group\\}\\} - \\{\\{/context.group\\}\\} Ratio of the count of log entries matching \\{\\{context.numeratorConditions\\}\\} to the count of log entries matching \\{\\{context.denominatorConditions\\}\\} was \\{\\{context.ratio\\}\\}\\{\\{/context.isRatio\\}\\}`,
-      }
-    ),
+    defaultActionMessage: logThresholdDefaultActionMessage,
+    defaultRecoveryMessage: logThresholdDefaultRecoveryMessage,
     requiresAppContext: false,
     format: createRuleFormatter(logsLocator),
   };

diff --git a/x-pack/plugins/infra/public/alerting/metric_threshold/index.ts b/x-pack/plugins/infra/public/alerting/metric_threshold/index.ts
@@ -20,6 +20,36 @@ export interface MetricThresholdRuleTypeParams extends RuleTypeParams {
   criteria: MetricExpressionParams[];
 }
 
+const metricThresholdDefaultActionMessage = i18n.translate(
+  'xpack.infra.metrics.alerting.metric.threshold.defaultActionMessage',
+  {
+    defaultMessage: `\\{\\{context.reason\\}\\}
+
+\\{\\{rule.name\\}\\} is active with the following conditions:
+
+- Affected: \\{\\{context.group\\}\\}
+- Metric: \\{\\{context.metric\\}\\}
+- Observed value: \\{\\{context.value\\}\\}
+- Threshold: \\{\\{context.threshold\\}\\}
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
+  }
+);
+const metricThresholdDefaultRecoveryMessage = i18n.translate(
+  'xpack.infra.metrics.alerting.metric.threshold.defaultRecoveryMessage',
+  {
+    defaultMessage: `\\{\\{rule.name\\}\\} has recovered.
+
+- Affected: \\{\\{context.group\\}\\}
+- Metric: \\{\\{context.metric\\}\\}
+- Threshold: \\{\\{context.threshold\\}\\}
+
+[View alert details](\\{\\{context.alertDetailsUrl\\}\\})
+`,
+  }
+);
+
 export function createMetricThresholdRuleType(): ObservabilityRuleTypeModel<MetricThresholdRuleTypeParams> {
   return {
     id: METRIC_THRESHOLD_ALERT_TYPE_ID,
@@ -32,16 +62,8 @@ export function createMetricThresholdRuleType(): ObservabilityRuleTypeModel<Metr
     },
     ruleParamsExpression: lazy(() => import('./components/expression')),
     validate: validateMetricThreshold,
-    defaultActionMessage: i18n.translate(
-      'xpack.infra.metrics.alerting.threshold.defaultActionMessage',
-      {
-        defaultMessage: `\\{\\{alertName\\}\\} - \\{\\{context.group\\}\\} is in a state of \\{\\{context.alertState\\}\\}
-
-Reason:
-\\{\\{context.reason\\}\\}
-`,
-      }
-    ),
+    defaultActionMessage: metricThresholdDefaultActionMessage,
+    defaultRecoveryMessage: metricThresholdDefaultRecoveryMessage,
     requiresAppContext: false,
     format: formatReason,
     alertDetailsAppSection: lazy(() => import('./components/alert_details_app_section')),