-
Notifications
You must be signed in to change notification settings - Fork 8.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Logs UI] Remove UUID from Alert Instances #71340
[Logs UI] Remove UUID from Alert Instances #71340
Conversation
Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui) |
async function ({ services, params }: AlertExecutorOptions) { | ||
const { alertInstanceFactory, savedObjectsClient, callCluster } = services; | ||
const { sources } = libs; | ||
const { groupBy } = params; | ||
|
||
const sourceConfiguration = await sources.getSourceConfiguration(savedObjectsClient, 'default'); | ||
const indexPattern = sourceConfiguration.configuration.logAlias; | ||
const alertInstance = alertInstanceFactory(alertId); | ||
const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is how we do it in Metrics, where error alert states just use the *
alert instance, but if y'all want to handle it differently in Logs please suggest a change.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍 Thanks for bringing this fix over to logs alongside metrics.
@elasticmachine merge upstream |
💚 Build SucceededBuild metrics
History
To update your PR or re-run it, just comment with: |
* [Logs UI] Remove UUID from Alert Instances * Fix bad template string Co-authored-by: Elastic Machine <[email protected]>
* master: (72 commits) [test] Skips test preventing promotion of ES snapshot elastic#71612 [Logs UI] Remove UUID from Alert Instances (elastic#71340) [Metrics UI] Remove UUID from Alert Instance IDs (elastic#71335) [ML] Functional tests - disable DFA creation and cloning tests [APM] Use status_code field to calculate error rate (elastic#71109) [Observability] Change appLink passing the date range (elastic#71259) [Security] Add Timeline improvements (elastic#71506) adjust vislib bar opacity (elastic#71421) Fix ScopedHistory mock and adapt usages (elastic#71404) [Security Solution] Add hook for reading/writing resolver query params (elastic#70809) [APM] Bug fixes from ML integration testing (elastic#71564) [Discover] Add caused_by.type and caused_by.reason to error toast modal (elastic#70404) [Security Solution] Add 3rd level breadcrumb to admin page (elastic#71275) [Security Solution][Exceptions] Exception modal bulk close alerts that match exception attributes (elastic#71321) Change signal.rule.risk score mapping from keyword to float (elastic#71126) Added help text where needed on connectors and alert actions UI (elastic#69601) [SIEM][Detections] Value Lists Management Modal (elastic#67068) [test] Skips test preventing promotion of ES snapshot elastic#71582 [test] Skips test preventing promotion of ES snapshot elastic#71555 [ILM] Fix alignment of the timing field (elastic#71273) ...
* [Logs UI] Remove UUID from Alert Instances * Fix bad template string Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: Zacqary Adam Xeper <[email protected]> Co-authored-by: Elastic Machine <[email protected]>
Hi @Zacqary Should this be included in the 7.9.0 release notes? I don't see it listed here: https://github.com/elastic/kibana/blob/0afaba21b39709739086e2aaa3a88a8a1bea855b/docs/CHANGELOG.asciidoc |
Summary
Fixes the Logs alert equivalent of #69623
Logs alerts will now generate alert instance IDs using only
group
instead ofuuid
andgroup
. This was creating problems with throttling and stability for users with multiple Kibana instances.It turns out we didn't need a unique
uuid
to differentiate alert instances. Multiple alerts can create an instance named*
without stepping on each other; what matters is that the ID is unique within an alert itself.While I was at it I decided to add
UNGROUPED_FACTORY_KEY
to metrics alerts as well.Checklist