[Logs UI] [Alerting] "Group by" functionality

x-pack/plugins/infra/common/alerting/logs/types.ts

@@ -4,6 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 import { i18n } from '@kbn/i18n';
+import * as rt from 'io-ts';
+import { commonSearchSuccessResponseFieldsRT } from '../../utils/elasticsearch_runtime_types';
 
 export const LOG_DOCUMENT_COUNT_ALERT_TYPE_ID = 'logs.alert.document.count';
 
@@ -20,6 +22,19 @@ export enum Comparator {
   NOT_MATCH_PHRASE = 'does not match phrase',
 }
 
+const ComparatorRT = rt.keyof({
+  [Comparator.GT]: null,
+  [Comparator.GT_OR_EQ]: null,
+  [Comparator.LT]: null,
+  [Comparator.LT_OR_EQ]: null,
+  [Comparator.EQ]: null,
+  [Comparator.NOT_EQ]: null,
+  [Comparator.MATCH]: null,
+  [Comparator.NOT_MATCH]: null,
+  [Comparator.MATCH_PHRASE]: null,
+  [Comparator.NOT_MATCH_PHRASE]: null,
+});
+
 // Maps our comparators to i18n strings, some comparators have more specific wording
 // depending on the field type the comparator is being used with.
 export const ComparatorToi18nMap = {
@@ -74,33 +89,71 @@ export enum AlertStates {
   ERROR,
 }
 
-export interface DocumentCount {
-  comparator: Comparator;
-  value: number;
-}
+const DocumentCountRT = rt.type({
+  comparator: ComparatorRT,
+  value: rt.number,
+});
 
-export interface Criterion {
-  field: string;
-  comparator: Comparator;
-  value: string | number;
-}
+export type DocumentCount = rt.TypeOf<typeof DocumentCountRT>;
 
-export interface LogDocumentCountAlertParams {
-  count: DocumentCount;
-  criteria: Criterion[];
-  timeUnit: 's' | 'm' | 'h' | 'd';
-  timeSize: number;
-  groupBy?: string[];
-}
+const CriterionRT = rt.type({
+  field: rt.string,
+  comparator: ComparatorRT,
+  value: rt.union([rt.string, rt.number]),
+});
 
-export type TimeUnit = 's' | 'm' | 'h' | 'd';
+export type Criterion = rt.TypeOf<typeof CriterionRT>;
 
-export interface Aggregations {
-  [key: string]: Record<string, object[]>;
-  interval_buckets: {
-    buckets: Array<{
-      key: Record<string, string>;
-      doc_count: number;
-    }>;
-  };
-}
+const TimeUnitRT = rt.union([rt.literal('s'), rt.literal('m'), rt.literal('h'), rt.literal('d')]);
+export type TimeUnit = rt.TypeOf<typeof TimeUnitRT>;
+
+export const LogDocumentCountAlertParamsRT = rt.intersection([
+  rt.type({
+    count: DocumentCountRT,
+    criteria: rt.array(CriterionRT),
+    timeUnit: TimeUnitRT,
+    timeSize: rt.number,
+  }),
+  rt.partial({
+    groupBy: rt.array(rt.string),
+  }),
+]);
+
+export type LogDocumentCountAlertParams = rt.TypeOf<typeof LogDocumentCountAlertParamsRT>;
+
+const UngroupedSearchQueryResponseRT = rt.intersection([
+  commonSearchSuccessResponseFieldsRT,
+  rt.type({
+    hits: rt.type({
+      total: rt.type({
+        value: rt.number,
+      }),
+    }),
+  }),
+]);
+
+export type UngroupedSearchQueryResponse = rt.TypeOf<typeof UngroupedSearchQueryResponseRT>;
+
+const GroupedSearchQueryResponseRT = rt.intersection([
+  commonSearchSuccessResponseFieldsRT,
+  rt.type({
+    aggregations: rt.type({
+      groups: rt.type({
+        buckets: rt.array(
+          rt.type({
+            key: rt.record(rt.string, rt.string),
+            doc_count: rt.number,
+          })
+        ),
+        after_key: rt.record(rt.string, rt.string),
+      }),
+    }),
+    hits: rt.type({
+      total: rt.type({
+        value: rt.number,
+      }),
+    }),
+  }),
+]);
+
+export type GroupedSearchQueryResponse = rt.TypeOf<typeof GroupedSearchQueryResponseRT>;

x-pack/plugins/infra/common/utils/elasticsearch_runtime_types.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import * as rt from 'io-ts';
+
+export const commonSearchSuccessResponseFieldsRT = rt.type({
+  _shards: rt.type({
+    total: rt.number,
+    successful: rt.number,
+    skipped: rt.number,
+    failed: rt.number,
+  }),
+  timed_out: rt.boolean,
+  took: rt.number,
+});

x-pack/plugins/infra/public/components/alerting/logs/expression_editor/editor.tsx

@@ -122,7 +122,6 @@ export const Editor: React.FC<Props> = (props) => {
   const { setAlertParams, alertParams, errors } = props;
   const [hasSetDefaults, setHasSetDefaults] = useState<boolean>(false);
   const { sourceStatus } = useLogSourceContext();
-
   useMount(() => {
     for (const [key, value] of Object.entries({ ...DEFAULT_EXPRESSION, ...alertParams })) {
       setAlertParams(key, value);
@@ -141,6 +140,17 @@ export const Editor: React.FC<Props> = (props) => {
     /* eslint-disable-next-line react-hooks/exhaustive-deps */
   }, [sourceStatus]);
 
+  const groupByFields = useMemo(() => {
+    if (sourceStatus?.logIndexFields) {
+      return sourceStatus.logIndexFields.filter((field) => {
+        return field.type === 'string' && field.searchable;
+      });
+    } else {
+      return [];
+    }
+    /* eslint-disable-next-line react-hooks/exhaustive-deps */
+  }, [sourceStatus]);
+
   const updateCount = useCallback(
     (countParams) => {
       const nextCountParams = { ...alertParams.count, ...countParams };
@@ -230,7 +240,7 @@ export const Editor: React.FC<Props> = (props) => {
       <GroupByExpression
         selectedGroups={alertParams.groupBy}
         onChange={updateGroupBy}
-        fields={supportedFields}
+        fields={groupByFields}
       />
 
       <div>
@@ -253,4 +263,4 @@ export const Editor: React.FC<Props> = (props) => {
 
 // required for dynamic import
 // eslint-disable-next-line import/no-default-export
-export default Editor;
+export default ExpressionEditor;

x-pack/plugins/infra/public/components/alerting/logs/log_threshold_alert_type.ts

@@ -22,7 +22,7 @@ export function getAlertType(): AlertTypeModel {
     defaultActionMessage: i18n.translate(
       'xpack.infra.logs.alerting.threshold.defaultActionMessage',
       {
-        defaultMessage: `\\{\\{context.group\\}\\} - \\{\\{context.matchingDocuments\\}\\} log entries have matched the following conditions: \\{\\{context.conditions\\}\\}`,
+        defaultMessage: `\\{\\{#context.group\\}\\}\\{\\{context.group\\}\\} - \\{\\{/context.group\\}\\}\\{\\{context.matchingDocuments\\}\\} log entries have matched the following conditions: \\{\\{context.conditions\\}\\}`,
       }
     ),
     requiresAppContext: false,

x-pack/plugins/infra/public/components/alerting/shared/group_by_expression/group_by_expression.tsx

@@ -30,7 +30,7 @@ const DEFAULT_GROUP_BY_LABEL = i18n.translate('xpack.infra.alerting.alertFlyout.
 const EVERYTHING_PLACEHOLDER = i18n.translate(
   'xpack.infra.alerting.alertFlyout.groupBy.placeholder',
   {
-    defaultMessage: 'Everything (ungrouped)',
+    defaultMessage: 'Nothing (ungrouped)',
   }
 );
 
@@ -46,9 +46,7 @@ export const GroupByExpression: React.FC<Props> = ({
     return selectedGroups.length > 0 ? selectedGroups.join(', ') : EVERYTHING_PLACEHOLDER;
   }, [selectedGroups]);
 
-  const labelProp = useMemo(() => {
-    return label || DEFAULT_GROUP_BY_LABEL;
-  }, [label]);
+  const labelProp = label ?? DEFAULT_GROUP_BY_LABEL;
 
   return (
     <EuiFlexGroup gutterSize="s">

x-pack/plugins/infra/public/components/alerting/shared/group_by_expression/selector.tsx

@@ -36,9 +36,7 @@ export const GroupBySelector = ({
   }, [selectedGroups]);
 
   const options = useMemo(() => {
-    return fields
-      .filter((field) => field.aggregatable && field.type === 'string')
-      .map((field) => ({ label: field.name }));
+    return fields.filter((field) => field.aggregatable).map((field) => ({ label: field.name }));
   }, [fields]);
 
   return (

x-pack/plugins/infra/server/lib/adapters/framework/adapter_types.ts

@@ -59,6 +59,7 @@ export interface InfraDatabaseSearchResponse<Hit = {}, Aggregations = undefined>
     skipped: number;
     failed: number;
   };
+  timed_out: boolean;
   aggregations?: Aggregations;
   hits: {
     total: {