Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Alerting] Rename index pattern to data view #111137

Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/user/alerting/rule-types/es-query.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ Define properties to detect the condition.
[role="screenshot"]
image::user/alerting/images/rule-types-es-query-conditions.png[Five clauses define the condition to detect]

Index:: This clause requires an *index or index pattern* and a *time field* that will be used for the *time window*.
Index:: This clause requires an *index or {data-source}* and a *time field* that will be used for the *time window*.
Size:: This clause specifies the number of documents to pass to the configured actions when the the threshold condition is met.
{es} query:: This clause specifies the ES DSL query to execute. The number of documents that match this query will be evaulated against the threshold
condition. Aggregations are not supported at this time.
Expand Down
10 changes: 5 additions & 5 deletions docs/user/alerting/rule-types/geo-rule-types.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,17 +10,17 @@ In the event that an entity is contained within a boundary, an alert may be gene
==== Requirements
To create a Tracking containment rule, the following requirements must be present:

- *Tracks index or index pattern*: An index containing a `geo_point` field, `date` field,
- *Tracks index or {data-source}*: An index containing a `geo_point` field, `date` field,
and some form of entity identifier. An entity identifier is a `keyword` or `number`
field that consistently identifies the entity to be tracked. The data in this index should be dynamically
updating so that there are entity movements to alert upon.
- *Boundaries index or index pattern*: An index containing `geo_shape` data, such as boundary data and bounding box data.
- *Boundaries index or {data-source}*: An index containing `geo_shape` data, such as boundary data and bounding box data.
This data is presumed to be static (not updating). Shape data matching the query is
harvested once when the rule is created and anytime after when the rule is re-enabled
after disablement.

By design, current interval entity locations (_current_ is determined by `date` in
the *Tracked index or index pattern*) are queried to determine if they are contained
the *Tracked index or {data-source}*) are queried to determine if they are contained
within any monitored boundaries. Entity
data should be somewhat "real time", meaning the dates of new documents aren’t older
than the current time minus the amount of the interval. If data older than
Expand All @@ -39,13 +39,13 @@ as well as 2 Kuery bars used to provide additional filtering context for each of
[role="screenshot"]
image::user/alerting/images/alert-types-tracking-containment-conditions.png[Five clauses define the condition to detect]

Index (entity):: This clause requires an *index or index pattern*, a *time field* that will be used for the *time window*, and a *`geo_point` field* for tracking.
Index (entity):: This clause requires an *index or {data-source}*, a *time field* that will be used for the *time window*, and a *`geo_point` field* for tracking.
When entity:: This clause specifies which crossing option to track. The values
*Entered*, *Exited*, and *Crossed* can be selected to indicate which crossing conditions
should trigger a rule. *Entered* alerts on entry into a boundary, *Exited* alerts on exit
from a boundary, and *Crossed* alerts on all boundary crossings whether they be entrances
or exits.
Index (Boundary):: This clause requires an *index or index pattern*, a *`geo_shape` field*
Index (Boundary):: This clause requires an *index or {data-source}*, a *`geo_shape` field*
identifying boundaries, and an optional *Human-readable boundary name* for better alerting
messages.

Expand Down
2 changes: 1 addition & 1 deletion docs/user/alerting/rule-types/index-threshold.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ Define properties to detect the condition.
[role="screenshot"]
image::user/alerting/images/rule-types-index-threshold-conditions.png[Five clauses define the condition to detect]

Index:: This clause requires an *index or index pattern* and a *time field* that will be used for the *time window*.
Index:: This clause requires an *index or {data-source}* and a *time field* that will be used for the *time window*.
When:: This clause specifies how the value to be compared to the threshold is calculated. The value is calculated by aggregating a numeric field a the *time window*. The aggregation options are: `count`, `average`, `sum`, `min`, and `max`. When using `count` the document count is used, and an aggregation field is not necessary.
Over/Grouped Over:: This clause lets you configure whether the aggregation is applied over all documents, or should be split into groups using a grouping field. If grouping is used, an <<alerting-concepts-alerts, alert>> will be created for each group when it exceeds the threshold. To limit the number of alerts on high cardinality fields, you must specify the number of groups to check against the threshold. Only the *top* groups are checked.
Threshold:: This clause defines a threshold value and a comparison operator (one of `is above`, `is above or equals`, `is below`, `is below or equals`, or `is between`). The result of the aggregation is compared to this threshold.
Expand Down
2 changes: 1 addition & 1 deletion x-pack/plugins/event_log/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,7 @@ For ad-hoc diagnostic purposes, your go to tools are Discover and Lens. Your
user will need to have access to the index, which is considered a Kibana
system index due to it's prefix.

Add the event log index as an index pattern. The only customization needed is
Add the event log index as a data view. The only customization needed is
to set the `event.duration` field to a duration in nanoseconds. You'll
probably want it displayed as milliseconds.

Expand Down

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
Expand Up @@ -162,7 +162,7 @@ export const BoundaryIndexExpression: FunctionComponent<Props> = ({

return (
<ExpressionWithPopover
defaultValue={'Select an index pattern and geo shape field'}
defaultValue={'Select a data view and geo shape field'}
value={boundaryIndexPattern.title}
popoverContent={indexPopover}
expressionDescription={i18n.translate('xpack.stackAlerts.geoContainment.indexLabel', {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,7 @@ export const EntityIndexExpression: FunctionComponent<Props> = ({
isInvalid={isInvalid}
value={indexPattern.title}
defaultValue={i18n.translate('xpack.stackAlerts.geoContainment.entityIndexSelect', {
defaultMessage: 'Select an index pattern and geo point field',
defaultMessage: 'Select a data view and geo point field',
})}
popoverContent={indexPopover}
expressionDescription={i18n.translate('xpack.stackAlerts.geoContainment.entityIndexLabel', {
Expand Down

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ test('should render without error after mounting', async () => {
expect(component).toMatchSnapshot();
});

test('should render with error when index pattern does not have geo_point field', async () => {
test('should render with error when data view does not have geo_point field', async () => {
const component = shallow(
<GeoIndexPatternSelect
http={({} as unknown) as HttpSetup}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ export class GeoIndexPatternSelect extends Component<Props, State> {
<>
<EuiCallOut
title={i18n.translate('xpack.stackAlerts.geoContainment.noIndexPattern.messageTitle', {
defaultMessage: `Couldn't find any index patterns`,
defaultMessage: `Couldn't find any data views`,
})}
color="warning"
>
Expand All @@ -105,7 +105,7 @@ export class GeoIndexPatternSelect extends Component<Props, State> {
>
<FormattedMessage
id="xpack.stackAlerts.geoContainment.noIndexPattern.doThisLinkTextDescription"
defaultMessage="Create an index pattern."
defaultMessage="Create a data view."
/>
</EuiLink>
</p>
Expand Down Expand Up @@ -135,7 +135,7 @@ export class GeoIndexPatternSelect extends Component<Props, State> {
const error = isIndexPatternInvalid
? i18n.translate('xpack.stackAlerts.geoContainment.noGeoFieldInIndexPattern.message', {
defaultMessage:
'Index pattern does not contain any allowed geospatial fields. Must have one of type {geoFields}.',
'Data view does not contain any allowed geospatial fields. Must have one of type {geoFields}.',
values: {
geoFields: this.props.includedGeoTypes.join(', '),
},
Expand All @@ -148,7 +148,7 @@ export class GeoIndexPatternSelect extends Component<Props, State> {

<EuiFormRow
label={i18n.translate('xpack.stackAlerts.geoContainment.indexPatternSelectLabel', {
defaultMessage: 'Index pattern',
defaultMessage: 'Data view',
})}
isInvalid={isIndexPatternInvalid}
error={error}
Expand All @@ -162,7 +162,7 @@ export class GeoIndexPatternSelect extends Component<Props, State> {
placeholder={i18n.translate(
'xpack.stackAlerts.geoContainment.indexPatternSelectPlaceholder',
{
defaultMessage: 'Select index pattern',
defaultMessage: 'Select data view',
}
)}
fieldTypes={this.props.includedGeoTypes}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ function fieldsToOptions(fields?: IFieldType[]): Array<EuiComboBoxOptionOption<I

interface Props {
placeholder: string;
value: string | null; // index pattern field name
value: string | null; // data view field name
onChange: (fieldName?: string) => void;
fields: IFieldType[];
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ quantities of data the frequency listed below (20000ms = 20s) or higher:
There are 3 separate tabs you'll need for a combination of loading and viewing the
data. Since you'll be jumping between them, it might be easiest to just open them
upfront. Each is preceded by `https://localhost:5601/<your dev env prefix>/app/`:
- Stack Management > Index Patterns: `management/kibana/indexPatterns`
- Stack Management > Data Views: `management/kibana/indexPatterns`
- Stack Management > Alerts & Actions: `management/insightsAndAlerting/triggersActions/alerts`
- Maps: `maps`

Expand All @@ -58,11 +58,11 @@ _ When finished uploading and adding the layer, save the map using a name of you
choice.
- Keep the Maps tab open, you'll come back to this

### 7. Create index pattern for generated tracks
- Go to the index pattern tab to create a new index pattern.
### 7. Create data view for generated tracks
- Go to the data view tab to create a new data view.
- Give it the index name `mtatracks*`
- For `Time field` select `@timestamp`
- Click `Create index pattern`
- Click `Create data view`
- Leave this tab open, you'll come back to this

### 8. Create containment alert
Expand Down Expand Up @@ -102,11 +102,11 @@ Entity: {{context.entityId}} with document ID: {{context.entityDocumentId}} has
- Boundary layer
- This layer should already be added from when you uploaded the GeoJSON
file earlier. If it's not already added, it can be added by selecting `Documents`
> `Index patterns` > `nyc-neighborhoods` then accept the defaults and add the layer.
> `Data views` > `nyc-neighborhoods` then accept the defaults and add the layer.
- Vehicle tracks
- Add `Tracks` > `Index patterns` > `mtatracks*`, accept the defaults selected and set `Entity` > `entity_id`. Add the layer and style appropriately.
- Add `Tracks` > `Data views` > `mtatracks*`, accept the defaults selected and set `Entity` > `entity_id`. Add the layer and style appropriately.
- Last known location
- Add `Documents` > `Index patterns` > `mtatracks*` and select `Show top hits per entity`
- Add `Documents` > `Data views` > `mtatracks*` and select `Show top hits per entity`
- For `Entity` select `entity_id` and add the layer.
- The only required setting on the following screen is to set `Sorting` to sort on `@timestamp`
- Update time scope of data
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ describe('expression params validation', () => {
boundaryGeoField: 'testField',
};
expect(validateExpression(initialParams).errors.index.length).toBeGreaterThan(0);
expect(validateExpression(initialParams).errors.index[0]).toBe('Index pattern is required.');
expect(validateExpression(initialParams).errors.index[0]).toBe('Data view is required.');
});

test('if geoField property is invalid should return proper error message', () => {
Expand Down Expand Up @@ -105,7 +105,7 @@ describe('expression params validation', () => {
};
expect(validateExpression(initialParams).errors.boundaryIndexTitle.length).toBeGreaterThan(0);
expect(validateExpression(initialParams).errors.boundaryIndexTitle[0]).toBe(
'Boundary index pattern title is required.'
'Boundary data view title is required.'
);
});

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ export const validateExpression = (alertParams: GeoContainmentAlertParams): Vali
if (!index) {
errors.index.push(
i18n.translate('xpack.stackAlerts.geoContainment.error.requiredIndexTitleText', {
defaultMessage: 'Index pattern is required.',
defaultMessage: 'Data view is required.',
})
);
}
Expand Down Expand Up @@ -76,7 +76,7 @@ export const validateExpression = (alertParams: GeoContainmentAlertParams): Vali
if (!boundaryIndexTitle) {
errors.boundaryIndexTitle.push(
i18n.translate('xpack.stackAlerts.geoContainment.error.requiredBoundaryIndexTitleText', {
defaultMessage: 'Boundary index pattern title is required.',
defaultMessage: 'Boundary data view title is required.',
})
);
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ export const getIndexOptions = async (
label: i18n.translate(
'xpack.triggersActionsUI.components.builtinActionTypes.indexAction.indicesAndIndexPatternsLabel',
{
defaultMessage: 'Based on your index patterns',
defaultMessage: 'Based on your data views',
}
),
options: matchingOptions.map((match) => {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ export default function ({ getService }: FtrProviderContext) {
}

describe(`Index Lifecycle`, () => {
it('should query across indicies matching the Event Log index pattern', async () => {
it('should query across indices matching the Event Log data view', async () => {
await esArchiver.load('x-pack/test/functional/es_archives/event_log_multiple_indicies');

const id = `421f2511-5cd1-44fd-95df-e0df83e354d5`;
Expand Down