[EventLog] Added event log API to get events for multiple saved objec…

…ts. (#87596) * Added alerting API to get all active instances * modofied event log findEventsBySavedObject to support bulk ids, renamed to findEventsBySavedObjectIds * fixed faling typechecks * fixed crash on zpd/api/event_log/alert/84c00970-5130-11eb-9fa7/_find for non existing id * fixed faling typechecks * fixed faling typechecks * fixed due to comments * fixed due to comments * fixed failing test * fixed due to comments
elastic · Jan 13, 2021 · fb67443 · fb67443
1 parent 5e4402c
commit fb67443
Show file tree

Hide file tree

Showing 18 changed files with 320 additions and 102 deletions.
diff --git a/x-pack/plugins/actions/server/plugin.ts b/x-pack/plugins/actions/server/plugin.ts
@@ -19,6 +19,7 @@ import {
  ElasticsearchServiceStart,
  ILegacyClusterClient,
  SavedObjectsClientContract,
+ SavedObjectsBulkGetObject,
 } from '../../../../src/core/server';
 
 import {
@@ -333,7 +334,12 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
 
  this.eventLogService!.registerSavedObjectProvider('action', (request) => {
  const client = secureGetActionsClientWithRequest(request);
- return async (type: string, id: string) => (await client).get({ id });
+ return (objects?: SavedObjectsBulkGetObject[]) =>
+ objects
+ ? Promise.all(
+ objects.map(async (objectItem) => await (await client).get({ id: objectItem.id }))
+ )
+ : Promise.resolve([]);
  });
 
  const getScopedSavedObjectsClientWithoutAccessToActions = (request: KibanaRequest) =>

diff --git a/x-pack/plugins/alerts/server/alerts_client/alerts_client.ts b/x-pack/plugins/alerts/server/alerts_client/alerts_client.ts
@@ -412,7 +412,7 @@ export class AlertsClient {
  this.logger.debug(`getAlertInstanceSummary(): search the event log for alert ${id}`);
  let events: IEvent[];
  try {
- const queryResults = await eventLogClient.findEventsBySavedObject('alert', id, {
+ const queryResults = await eventLogClient.findEventsBySavedObjectIds('alert', [id], {
  page: 1,
  per_page: 10000,
  start: parsedDateStart.toISOString(),

diff --git a/x-pack/plugins/alerts/server/alerts_client/tests/get_alert_instance_summary.test.ts b/x-pack/plugins/alerts/server/alerts_client/tests/get_alert_instance_summary.test.ts
@@ -131,7 +131,7 @@ describe('getAlertInstanceSummary()', () => {
  total: events.length,
  data: events,
  };
- eventLogClient.findEventsBySavedObject.mockResolvedValueOnce(eventsResult);
+ eventLogClient.findEventsBySavedObjectIds.mockResolvedValueOnce(eventsResult);
 
  const dateStart = new Date(Date.now() - 60 * 1000).toISOString();
 
@@ -188,18 +188,20 @@ describe('getAlertInstanceSummary()', () => {
 
  test('calls saved objects and event log client with default params', async () => {
  unsecuredSavedObjectsClient.get.mockResolvedValueOnce(getAlertInstanceSummarySavedObject());
- eventLogClient.findEventsBySavedObject.mockResolvedValueOnce(
+ eventLogClient.findEventsBySavedObjectIds.mockResolvedValueOnce(
  AlertInstanceSummaryFindEventsResult
  );
 
  await alertsClient.getAlertInstanceSummary({ id: '1' });
 
  expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledTimes(1);
- expect(eventLogClient.findEventsBySavedObject).toHaveBeenCalledTimes(1);
- expect(eventLogClient.findEventsBySavedObject.mock.calls[0]).toMatchInlineSnapshot(`
+ expect(eventLogClient.findEventsBySavedObjectIds).toHaveBeenCalledTimes(1);
+ expect(eventLogClient.findEventsBySavedObjectIds.mock.calls[0]).toMatchInlineSnapshot(`
  Array [
  "alert",
- "1",
+ Array [
+ "1",
+ ],
  Object {
  "end": "2019-02-12T21:01:22.479Z",
  "page": 1,
@@ -210,7 +212,7 @@ describe('getAlertInstanceSummary()', () => {
  ]
  `);
  // calculate the expected start/end date for one test
- const { start, end } = eventLogClient.findEventsBySavedObject.mock.calls[0][2]!;
+ const { start, end } = eventLogClient.findEventsBySavedObjectIds.mock.calls[0][2]!;
  expect(end).toBe(mockedDateString);
 
  const startMillis = Date.parse(start!);
@@ -222,7 +224,7 @@ describe('getAlertInstanceSummary()', () => {
 
  test('calls event log client with start date', async () => {
  unsecuredSavedObjectsClient.get.mockResolvedValueOnce(getAlertInstanceSummarySavedObject());
- eventLogClient.findEventsBySavedObject.mockResolvedValueOnce(
+ eventLogClient.findEventsBySavedObjectIds.mockResolvedValueOnce(
  AlertInstanceSummaryFindEventsResult
  );
 
@@ -232,8 +234,8 @@ describe('getAlertInstanceSummary()', () => {
  await alertsClient.getAlertInstanceSummary({ id: '1', dateStart });
 
  expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledTimes(1);
- expect(eventLogClient.findEventsBySavedObject).toHaveBeenCalledTimes(1);
- const { start, end } = eventLogClient.findEventsBySavedObject.mock.calls[0][2]!;
+ expect(eventLogClient.findEventsBySavedObjectIds).toHaveBeenCalledTimes(1);
+ const { start, end } = eventLogClient.findEventsBySavedObjectIds.mock.calls[0][2]!;
 
  expect({ start, end }).toMatchInlineSnapshot(`
  Object {
@@ -245,16 +247,16 @@ describe('getAlertInstanceSummary()', () => {
 
  test('calls event log client with relative start date', async () => {
  unsecuredSavedObjectsClient.get.mockResolvedValueOnce(getAlertInstanceSummarySavedObject());
- eventLogClient.findEventsBySavedObject.mockResolvedValueOnce(
+ eventLogClient.findEventsBySavedObjectIds.mockResolvedValueOnce(
  AlertInstanceSummaryFindEventsResult
  );
 
  const dateStart = '2m';
  await alertsClient.getAlertInstanceSummary({ id: '1', dateStart });
 
  expect(unsecuredSavedObjectsClient.get).toHaveBeenCalledTimes(1);
- expect(eventLogClient.findEventsBySavedObject).toHaveBeenCalledTimes(1);
- const { start, end } = eventLogClient.findEventsBySavedObject.mock.calls[0][2]!;
+ expect(eventLogClient.findEventsBySavedObjectIds).toHaveBeenCalledTimes(1);
+ const { start, end } = eventLogClient.findEventsBySavedObjectIds.mock.calls[0][2]!;
 
  expect({ start, end }).toMatchInlineSnapshot(`
  Object {
@@ -266,7 +268,7 @@ describe('getAlertInstanceSummary()', () => {
 
  test('invalid start date throws an error', async () => {
  unsecuredSavedObjectsClient.get.mockResolvedValueOnce(getAlertInstanceSummarySavedObject());
- eventLogClient.findEventsBySavedObject.mockResolvedValueOnce(
+ eventLogClient.findEventsBySavedObjectIds.mockResolvedValueOnce(
  AlertInstanceSummaryFindEventsResult
  );
 
@@ -280,7 +282,7 @@ describe('getAlertInstanceSummary()', () => {
 
  test('saved object get throws an error', async () => {
  unsecuredSavedObjectsClient.get.mockRejectedValueOnce(new Error('OMG!'));
- eventLogClient.findEventsBySavedObject.mockResolvedValueOnce(
+ eventLogClient.findEventsBySavedObjectIds.mockResolvedValueOnce(
  AlertInstanceSummaryFindEventsResult
  );
 
@@ -291,7 +293,7 @@ describe('getAlertInstanceSummary()', () => {
 
  test('findEvents throws an error', async () => {
  unsecuredSavedObjectsClient.get.mockResolvedValueOnce(getAlertInstanceSummarySavedObject());
- eventLogClient.findEventsBySavedObject.mockRejectedValueOnce(new Error('OMG 2!'));
+ eventLogClient.findEventsBySavedObjectIds.mockRejectedValueOnce(new Error('OMG 2!'));
 
  // error eaten but logged
  await alertsClient.getAlertInstanceSummary({ id: '1' });

diff --git a/x-pack/plugins/alerts/server/plugin.ts b/x-pack/plugins/alerts/server/plugin.ts
@@ -33,6 +33,7 @@ import {
  ILegacyClusterClient,
  StatusServiceSetup,
  ServiceStatus,
+ SavedObjectsBulkGetObject,
 } from '../../../../src/core/server';
 
 import {
@@ -370,7 +371,10 @@ export class AlertingPlugin {
 
  this.eventLogService!.registerSavedObjectProvider('alert', (request) => {
  const client = getAlertsClientWithRequest(request);
- return (type: string, id: string) => client.get({ id });
+ return (objects?: SavedObjectsBulkGetObject[]) =>
+ objects
+ ? Promise.all(objects.map(async (objectItem) => await client.get({ id: objectItem.id })))
+ : Promise.resolve([]);
  });
 
  scheduleAlertingTelemetry(this.telemetryLogger, plugins.taskManager);

diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.mock.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.mock.ts
@@ -16,7 +16,7 @@ const createClusterClientMock = () => {
  createIndexTemplate: jest.fn(),
  doesAliasExist: jest.fn(),
  createIndex: jest.fn(),
- queryEventsBySavedObject: jest.fn(),
+ queryEventsBySavedObjects: jest.fn(),
  shutdown: jest.fn(),
  };
  return mock;

diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts
@@ -327,11 +327,11 @@ describe('queryEventsBySavedObject', () => {
  total: { value: 0 },
  },
  });
- await clusterClientAdapter.queryEventsBySavedObject(
+ await clusterClientAdapter.queryEventsBySavedObjects(
  'index-name',
  'namespace',
  'saved-object-type',
- 'saved-object-id',
+ ['saved-object-id'],
  DEFAULT_OPTIONS
  );
 
@@ -365,10 +365,10 @@ describe('queryEventsBySavedObject', () => {
  },
  },
  Object {
- "term": Object {
- "kibana.saved_objects.id": Object {
- "value": "saved-object-id",
- },
+ "terms": Object {
+ "kibana.saved_objects.id": Array [
+ "saved-object-id",
+ ],
  },
  },
  Object {
@@ -406,11 +406,11 @@ describe('queryEventsBySavedObject', () => {
  total: { value: 0 },
  },
  });
- await clusterClientAdapter.queryEventsBySavedObject(
+ await clusterClientAdapter.queryEventsBySavedObjects(
  'index-name',
  undefined,
  'saved-object-type',
- 'saved-object-id',
+ ['saved-object-id'],
  DEFAULT_OPTIONS
  );
 
@@ -444,10 +444,10 @@ describe('queryEventsBySavedObject', () => {
  },
  },
  Object {
- "term": Object {
- "kibana.saved_objects.id": Object {
- "value": "saved-object-id",
- },
+ "terms": Object {
+ "kibana.saved_objects.id": Array [
+ "saved-object-id",
+ ],
  },
  },
  Object {
@@ -487,11 +487,11 @@ describe('queryEventsBySavedObject', () => {
  total: { value: 0 },
  },
  });
- await clusterClientAdapter.queryEventsBySavedObject(
+ await clusterClientAdapter.queryEventsBySavedObjects(
  'index-name',
  'namespace',
  'saved-object-type',
- 'saved-object-id',
+ ['saved-object-id'],
  { ...DEFAULT_OPTIONS, sort_field: 'event.end', sort_order: 'desc' }
  );
 
@@ -515,11 +515,11 @@ describe('queryEventsBySavedObject', () => {
 
  const start = '2020-07-08T00:52:28.350Z';
 
- await clusterClientAdapter.queryEventsBySavedObject(
+ await clusterClientAdapter.queryEventsBySavedObjects(
  'index-name',
  'namespace',
  'saved-object-type',
- 'saved-object-id',
+ ['saved-object-id'],
  { ...DEFAULT_OPTIONS, start }
  );
 
@@ -553,10 +553,10 @@ describe('queryEventsBySavedObject', () => {
  },
  },
  Object {
- "term": Object {
- "kibana.saved_objects.id": Object {
- "value": "saved-object-id",
- },
+ "terms": Object {
+ "kibana.saved_objects.id": Array [
+ "saved-object-id",
+ ],
  },
  },
  Object {
@@ -605,11 +605,11 @@ describe('queryEventsBySavedObject', () => {
  const start = '2020-07-08T00:52:28.350Z';
  const end = '2020-07-08T00:00:00.000Z';
 
- await clusterClientAdapter.queryEventsBySavedObject(
+ await clusterClientAdapter.queryEventsBySavedObjects(
  'index-name',
  'namespace',
  'saved-object-type',
- 'saved-object-id',
+ ['saved-object-id'],
  { ...DEFAULT_OPTIONS, start, end }
  );
 
@@ -643,10 +643,10 @@ describe('queryEventsBySavedObject', () => {
  },
  },
  Object {
- "term": Object {
- "kibana.saved_objects.id": Object {
- "value": "saved-object-id",
- },
+ "terms": Object {
+ "kibana.saved_objects.id": Array [
+ "saved-object-id",
+ ],
  },
  },
  Object {

diff --git a/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts b/x-pack/plugins/event_log/server/es/cluster_client_adapter.ts
@@ -194,11 +194,11 @@ export class ClusterClientAdapter {
  }
  }
 
- public async queryEventsBySavedObject(
+ public async queryEventsBySavedObjects(
  index: string,
  namespace: string | undefined,
  type: string,
- id: string,
+ ids: string[],
  // eslint-disable-next-line @typescript-eslint/naming-convention
  { page, per_page: perPage, start, end, sort_field, sort_order }: FindOptionsType
  ): Promise<QueryEventsBySavedObjectResult> {
@@ -249,10 +249,9 @@ export class ClusterClientAdapter {
  },
  },
  {
- term: {
- 'kibana.saved_objects.id': {
- value: id,
- },
+ terms: {
+ // default maximum of 65,536 terms, configurable by index.max_terms_count
+ 'kibana.saved_objects.id': ids,
  },
  },
  namespaceQuery,
@@ -298,7 +297,7 @@ export class ClusterClientAdapter {
  };
  } catch (err) {
  throw new Error(
- `querying for Event Log by for type "${type}" and id "${id}" failed with: ${err.message}`
+ `querying for Event Log by for type "${type}" and ids "${ids}" failed with: ${err.message}`
  );
  }
  }

diff --git a/x-pack/plugins/event_log/server/event_log_client.mock.ts b/x-pack/plugins/event_log/server/event_log_client.mock.ts
@@ -8,7 +8,7 @@ import { IEventLogClient } from './types';
 
 const createEventLogClientMock = () => {
  const mock: jest.Mocked<IEventLogClient> = {
- findEventsBySavedObject: jest.fn(),
+ findEventsBySavedObjectIds: jest.fn(),
  };
  return mock;
 };