Mark rule run as failure if there was an error (#62383)

While we still let the rule execute in the case of gap errors and stopped ML jobs, we now mark that execution as a failure instead of a success.
elastic · Apr 3, 2020 · cb5c510 · cb5c510
1 parent f467b99
commit cb5c510
Showing 1 changed file with 18 additions and 13 deletions.
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/signal_rule_alert_type.ts
@@ -55,6 +55,7 @@ export const signalRulesAlertType = ({
         index,
         filters,
         language,
+        maxSignals,
         meta,
         machineLearningJobId,
         outputIndex,
@@ -63,6 +64,14 @@ export const signalRulesAlertType = ({
         to,
         type,
       } = params;
+      const searchAfterSize = Math.min(maxSignals, DEFAULT_SEARCH_AFTER_PAGE_SIZE);
+      let hasError: boolean = false;
+      let result: SearchAfterAndBulkCreateReturnType = {
+        success: false,
+        bulkCreateTimes: [],
+        searchAfterTimes: [],
+        lastLookBackDate: null,
+      };
       const ruleStatusClient = ruleStatusSavedObjectsClientFactory(services.savedObjectsClient);
       const ruleStatusService = await ruleStatusServiceFactory({
         alertId,
@@ -104,17 +113,10 @@ export const signalRulesAlertType = ({
         );
         logger.warn(gapMessage);
 
+        hasError = true;
         await ruleStatusService.error(gapMessage, { gap: gapString });
       }
 
-      const searchAfterSize = Math.min(params.maxSignals, DEFAULT_SEARCH_AFTER_PAGE_SIZE);
-      let result: SearchAfterAndBulkCreateReturnType = {
-        success: false,
-        bulkCreateTimes: [],
-        searchAfterTimes: [],
-        lastLookBackDate: null,
-      };
-
       try {
         if (isMlRule(type)) {
           if (ml == null) {
@@ -143,6 +145,7 @@ export const signalRulesAlertType = ({
               `datafeed status: "${jobSummary?.datafeedState}"`
             );
             logger.warn(errorMessage);
+            hasError = true;
             await ruleStatusService.error(errorMessage);
           }
 
@@ -270,11 +273,13 @@ export const signalRulesAlertType = ({
           }
 
           logger.debug(buildRuleMessage('[+] Signal Rule execution completed.'));
-          await ruleStatusService.success('succeeded', {
-            bulkCreateTimeDurations: result.bulkCreateTimes,
-            searchAfterTimeDurations: result.searchAfterTimes,
-            lastLookBackDate: result.lastLookBackDate?.toISOString(),
-          });
+          if (!hasError) {
+            await ruleStatusService.success('succeeded', {
+              bulkCreateTimeDurations: result.bulkCreateTimes,
+              searchAfterTimeDurations: result.searchAfterTimes,
+              lastLookBackDate: result.lastLookBackDate?.toISOString(),
+            });
+          }
         } else {
           const errorMessage = buildRuleMessage(
             'Bulk Indexing of signals failed. Check logs for further details.'