[ES Query] Make rule created in Discover visible in Observability

[Zacqary]

Summary

Closes #170497

Adds scope dropdown to ES Query rules created from Discovery. If Logs or Metrics are selected, rules created here will be visible in Observability.

Also makes Logs the default consumer when creating a rule from either Discovery and Observability.

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

[apmmachine]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
• /oblt-deploy-serverless : Deploy a serverless Kibana instance using the Observability test environments.
• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[elasticmachine]

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

[XavierM]

@Zacqary I tested your PR and realized that it was removing some functionality that has been implemented. We need to add more functional testing so we do not reproduce the effect that everything is good until someone test it.

I think we can make discover rule work like the new o11y threshold and es query by just doing that https://gist.github.com/XavierM/a87f9ef5f4df7b1b6a0cb29f37922cf3.

In stateful, the user we will have to pick between logs, infrastructure and stackAlerts like we do in the rule management page. However, when we are in server-less, it will default it to observability and for the other project like search and security, it will default it to stackAlerts without any user interaction.

[XavierM]

Good call!

[Zacqary]

You can thank the failing tests for this one

[XavierM]

Since initialSelectedConsumer?: RuleCreationValidConsumer | null; can be undefined or null. Do you think it will be a good idea to do something like that to make sure that STACK_ALERTS_FEATURE_ID is selected if a dev forget to initialize the value

 useEffect(() => {
    // At initialization, select the first value
    if (!validatedSelectedConsumer) {
      if(consumers.includes(STACK_ALERTS_FEATURE_ID) {
          onChange(STACK_ALERTS_FEATURE_ID);
          return;
      }
       onChange(consumers[0] as RuleCreationValidConsumer);
    }
    // eslint-disable-next-line react-hooks/exhaustive-deps
  }, []);

[Zacqary]

Sure, that makes sense

[XavierM]

@Zacqary I tested this different scenario and it works like a charm.

I created es-query and o11y custom threshold in all the different project in server-less and for observability project we used the new observability feature id as consumer and for search/security project, we are using stackAlerts.

For the stateful, everything work as expected. My es-query rule from discover will default to logs and same when I created this rule from o11y rule management and if I created from the stack management, then we are using stackAlerts. Then, I created a role where I am excluding logs feature. At this point, we will default to Metrics/Infrastructure as it should be and keep it as stackAlerts for stack rule management page.

[marshallmain]

Detections and Response changes LGTM

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 729f036

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/rule-data-utils	114	115	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
discover	589.6KB	589.7KB	+126.0B
observability	1.1MB	1.1MB	+34.0B
triggersActionsUi	1.4MB	1.4MB	+382.0B
total			+542.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
stackAlerts	23.9KB	24.0KB	+115.0B
triggersActionsUi	104.1KB	104.1KB	+53.0B
total			+168.0B

Unknown metric groups

API count

id	before	after	diff
@kbn/rule-data-utils	117	118	+1

References to deprecated APIs

id	before	after	diff
stackAlerts	20	21	+1

History

• 💔 Build #181022 failed e48be57
• 💚 Build #180734 succeeded 040d0de
• 💔 Build #180644 failed a826a7b
• 💔 Build #180627 failed 5f648dd
• 💔 Build #180616 failed 12c7a13

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[davismcphee]

Discover changes LGTM 👍

I tested creating a rule with the default selection in Discover in stateful both as a user with and without o11y privileges:

• The dropdown was visible for the user with management and o11y privileges, and the rule appeared in both management and o11y.
• The dropdown was not visible for the user with only management privileges, and the rule only appeared in management.

The only thing that surprised me was that when I created a rule in Discover as the user with both privileges, and left the dropdown selection as the logs default, the rule wasn't visible in management by the user who only had management privileges. This is a change I wasn't expecting, but I assume it's working as intended and users will now have to select "Stack Rules" in order for the rule to show up in management for those who don't have o11y privileges?

I also tested in an o11y project and a search project -- the dropdown was visible in neither, I was able to create a rule in Discover in both, and the rule was visible in each project's available rule page.

[mgiota]

O11y changes LGTM!

One question I ran the project on serverless yarn serverless-oblt. Discover is not available there. In which project mode do I need to run kibana to see Discover?

[maryam-saeidi]

One question I ran the project on serverless yarn serverless-oblt. Discover is not available there. In which project mode do I need to run kibana to see Discover?

@mgiota By default, Discover is not visible in Serverless, but if you select a data view in Logs Explorer, you will be sent to Discover since the data view is not supported on this page yet.