fixed due to comments

elastic · Oct 14, 2021 · cbcd252 · cbcd252
1 parent ef343d6
commit cbcd252
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 21 deletions.
diff --git a/x-pack/plugins/alerting/server/rules_client/rules_client.ts b/x-pack/plugins/alerting/server/rules_client/rules_client.ts
@@ -1227,7 +1227,7 @@ export class RulesClient {
         const { group: actionGroup, subgroup: actionSubgroup } =
           recoveredAlertInstances[instanceId].getLastScheduledActions() ?? {};
         const instanceState = recoveredAlertInstances[instanceId].getState();
-        const message = `instance '${instanceId}' has recovered`;
+        const message = `instance '${instanceId}' has recovered due to the rule was disabled`;
 
         const event = createAlertEventLogRecordObject({
           ruleId: id,

diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/disable.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/disable.ts
@@ -380,14 +380,22 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
         });
 
         it('should create recovered-instance events for all alert instances', async () => {
+          // pattern of when the alert should fire
+          const pattern = {
+            instance: [false, true, true, false, false, true, true, true],
+          };
           const { body: createdRule } = await supertest
             .post(`${getUrlPrefix(space.id)}/api/alerting/rule`)
             .set('kbn-xsrf', 'foo')
             .send(
               getTestAlertData({
-                rule_type_id: 'test.noop',
-                consumer: 'alerts',
-                enabled: true,
+                rule_type_id: 'test.patternFiring',
+                schedule: { interval: '1s' },
+                throttle: null,
+                params: {
+                  pattern,
+                },
+                actions: [],
               })
             )
             .expect(200);
@@ -398,36 +406,30 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
           await alertUtils.getDisableRequest(ruleId);
 
           const events = await retry.try(async () => {
-            // there can be a successful execute before the error one
-            const someEvents = await getEventLog({
+            return await getEventLog({
               getService,
               spaceId: space.id,
               type: 'alert',
               id: ruleId,
               provider: 'alerting',
-              actions: new Map([['recovered-instance', { equal: 2 }]]),
+              actions: new Map([
+                // make sure the counts of the # of events per type are as expected
+                ['execute', { gte: 9 }],
+                ['new-instance', { equal: 2 }],
+                ['recovered-instance', { equal: 2 }],
+              ]),
             });
-            const errorEvents = someEvents.filter(
-              (event) => event?.kibana?.alerting?.status === 'error'
-            );
-            if (errorEvents.length === 0) {
-              throw new Error('no execute/error events yet');
-            }
-            return errorEvents;
           });
 
           const event = events[0];
           expect(event).to.be.ok();
 
           validateEvent(event, {
             spaceId: space.id,
-            savedObjects: [{ type: 'alert', id: ruleId, rel: 'primary', type_id: 'test.noop' }],
-            outcome: 'failure',
-            message: `test.noop:${ruleId}: execution failed`,
-            errorMessage: 'Unable to decrypt attribute "apiKey"',
-            status: 'error',
-            reason: 'decrypt',
-            shouldHaveTask: true,
+            savedObjects: [
+              { type: 'alert', id: ruleId, rel: 'primary', type_id: 'test.patternFiring' },
+            ],
+            message: '',
             rule: {
               id: ruleId,
               category: createdRule.body.rule_type_id,