Skip to content

Commit

Permalink
[Logs UI] Fix alerts recovery (#87369)
Browse files Browse the repository at this point in the history 
* Ensure that if alert instances are instantiated they are used in a way recognised by the framework
  • Loading branch information
@Kerry350
Kerry350 authored Jan 7, 2021
1 parent b75cd4b commit 81f7108
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 113 deletions.
98 changes: 3 additions & 95 deletions x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -413,31 +413,6 @@ describe('Log threshold executor', () => {

describe('Results processors', () => {
describe('Can process ungrouped results', () => {
test('It handles the OK state correctly', () => {
const alertInstanceUpdaterMock = jest.fn();
const alertParams = {
...baseAlertParams,
criteria: [positiveCriteria[0]],
};
const results = {
hits: {
total: {
value: 2,
},
},
} as UngroupedSearchQueryResponse;
processUngroupedResults(
results,
alertParams,
alertsMock.createAlertInstanceFactory,
alertInstanceUpdaterMock
);
// First call, second argument
expect(alertInstanceUpdaterMock.mock.calls[0][1]).toBe(AlertStates.OK);
// First call, third argument
expect(alertInstanceUpdaterMock.mock.calls[0][2]).toBe(undefined);
});

test('It handles the ALERT state correctly', () => {
const alertInstanceUpdaterMock = jest.fn();
const alertParams = {
Expand Down Expand Up @@ -475,68 +450,6 @@ describe('Log threshold executor', () => {
});

describe('Can process grouped results', () => {
test('It handles the OK state correctly', () => {
const alertInstanceUpdaterMock = jest.fn();
const alertParams = {
...baseAlertParams,
criteria: [positiveCriteria[0]],
groupBy: ['host.name', 'event.dataset'],
};
const results = [
{
key: {
'host.name': 'i-am-a-host-name',
'event.dataset': 'i-am-a-dataset',
},
doc_count: 100,
filtered_results: {
doc_count: 1,
},
},
{
key: {
'host.name': 'i-am-a-host-name',
'event.dataset': 'i-am-a-dataset',
},
doc_count: 100,
filtered_results: {
doc_count: 2,
},
},
{
key: {
'host.name': 'i-am-a-host-name',
'event.dataset': 'i-am-a-dataset',
},
doc_count: 100,
filtered_results: {
doc_count: 3,
},
},
] as GroupedSearchQueryResponse['aggregations']['groups']['buckets'];
processGroupByResults(
results,
alertParams,
alertsMock.createAlertInstanceFactory,
alertInstanceUpdaterMock
);
expect(alertInstanceUpdaterMock.mock.calls.length).toBe(3);
// First call, second argument
expect(alertInstanceUpdaterMock.mock.calls[0][1]).toBe(AlertStates.OK);
// First call, third argument
expect(alertInstanceUpdaterMock.mock.calls[0][2]).toBe(undefined);

// Second call, second argument
expect(alertInstanceUpdaterMock.mock.calls[1][1]).toBe(AlertStates.OK);
// Second call, third argument
expect(alertInstanceUpdaterMock.mock.calls[1][2]).toBe(undefined);

// Third call, second argument
expect(alertInstanceUpdaterMock.mock.calls[2][1]).toBe(AlertStates.OK);
// Third call, third argument
expect(alertInstanceUpdaterMock.mock.calls[2][2]).toBe(undefined);
});

test('It handles the ALERT state correctly', () => {
const alertInstanceUpdaterMock = jest.fn();
const alertParams = {
Expand Down Expand Up @@ -583,7 +496,7 @@ describe('Log threshold executor', () => {
alertsMock.createAlertInstanceFactory,
alertInstanceUpdaterMock
);
expect(alertInstanceUpdaterMock.mock.calls.length).toBe(results.length);
expect(alertInstanceUpdaterMock.mock.calls.length).toBe(2);
// First call, second argument
expect(alertInstanceUpdaterMock.mock.calls[0][1]).toBe(AlertStates.ALERT);
// First call, third argument
Expand All @@ -600,14 +513,9 @@ describe('Log threshold executor', () => {
]);

// Second call, second argument
expect(alertInstanceUpdaterMock.mock.calls[1][1]).toBe(AlertStates.OK);
expect(alertInstanceUpdaterMock.mock.calls[1][1]).toBe(AlertStates.ALERT);
// Second call, third argument
expect(alertInstanceUpdaterMock.mock.calls[1][2]).toBe(undefined);

// Third call, second argument
expect(alertInstanceUpdaterMock.mock.calls[2][1]).toBe(AlertStates.ALERT);
// Third call, third argument
expect(alertInstanceUpdaterMock.mock.calls[2][2]).toEqual([
expect(alertInstanceUpdaterMock.mock.calls[1][2]).toEqual([
{
actionGroup: 'logs.threshold.fired',
context: {
Expand Down
22 changes: 4 additions & 18 deletions x-pack/plugins/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,6 @@ export const createLogThresholdExecutor = (libs: InfraBackendLibs) =>
const sourceConfiguration = await sources.getSourceConfiguration(savedObjectsClient, 'default');
const indexPattern = sourceConfiguration.configuration.logAlias;
const timestampField = sourceConfiguration.configuration.fields.timestamp;
const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY);

try {
const validatedParams = decodeOrThrow(alertParamsRT)(params);
Expand All @@ -95,10 +94,6 @@ export const createLogThresholdExecutor = (libs: InfraBackendLibs) =>
);
}
} catch (e) {
alertInstance.replaceState({
alertState: AlertStates.ERROR,
});

throw new Error(e);
}
};
Expand Down Expand Up @@ -198,11 +193,10 @@ export const processUngroupedResults = (
alertInstaceUpdater: AlertInstanceUpdater
) => {
const { count, criteria } = params;

const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY);
const documentCount = results.hits.total.value;

if (checkValueAgainstComparatorMap[count.comparator](documentCount, count.value)) {
const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY);
alertInstaceUpdater(alertInstance, AlertStates.ALERT, [
{
actionGroup: FIRED_ACTIONS.id,
Expand All @@ -214,8 +208,6 @@ export const processUngroupedResults = (
},
},
]);
} else {
alertInstaceUpdater(alertInstance, AlertStates.OK);
}
};

Expand All @@ -228,12 +220,12 @@ export const processUngroupedRatioResults = (
) => {
const { count, criteria } = params;

const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY);
const numeratorCount = numeratorResults.hits.total.value;
const denominatorCount = denominatorResults.hits.total.value;
const ratio = getRatio(numeratorCount, denominatorCount);

if (ratio !== undefined && checkValueAgainstComparatorMap[count.comparator](ratio, count.value)) {
const alertInstance = alertInstanceFactory(UNGROUPED_FACTORY_KEY);
alertInstaceUpdater(alertInstance, AlertStates.ALERT, [
{
actionGroup: FIRED_ACTIONS.id,
Expand All @@ -246,8 +238,6 @@ export const processUngroupedRatioResults = (
},
},
]);
} else {
alertInstaceUpdater(alertInstance, AlertStates.OK);
}
};

Expand Down Expand Up @@ -286,10 +276,10 @@ export const processGroupByResults = (
const groupResults = getReducedGroupByResults(results);

groupResults.forEach((group) => {
const alertInstance = alertInstanceFactory(group.name);
const documentCount = group.documentCount;

if (checkValueAgainstComparatorMap[count.comparator](documentCount, count.value)) {
const alertInstance = alertInstanceFactory(group.name);
alertInstaceUpdater(alertInstance, AlertStates.ALERT, [
{
actionGroup: FIRED_ACTIONS.id,
Expand All @@ -301,8 +291,6 @@ export const processGroupByResults = (
},
},
]);
} else {
alertInstaceUpdater(alertInstance, AlertStates.OK);
}
});
};
Expand All @@ -320,7 +308,6 @@ export const processGroupByRatioResults = (
const denominatorGroupResults = getReducedGroupByResults(denominatorResults);

numeratorGroupResults.forEach((numeratorGroup) => {
const alertInstance = alertInstanceFactory(numeratorGroup.name);
const numeratorDocumentCount = numeratorGroup.documentCount;
const denominatorGroup = denominatorGroupResults.find(
(_group) => _group.name === numeratorGroup.name
Expand All @@ -333,6 +320,7 @@ export const processGroupByRatioResults = (
ratio !== undefined &&
checkValueAgainstComparatorMap[count.comparator](ratio, count.value)
) {
const alertInstance = alertInstanceFactory(numeratorGroup.name);
alertInstaceUpdater(alertInstance, AlertStates.ALERT, [
{
actionGroup: FIRED_ACTIONS.id,
Expand All @@ -345,8 +333,6 @@ export const processGroupByRatioResults = (
},
},
]);
} else {
alertInstaceUpdater(alertInstance, AlertStates.OK);
}
});
};
Expand Down

0 comments on commit 81f7108

Please sign in to comment.