Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[RAM] [META] Add Logs in Rule details page #126624

Open
XavierM opened this issue Mar 1, 2022 · 3 comments
Open

[RAM] [META] Add Logs in Rule details page #126624

XavierM opened this issue Mar 1, 2022 · 3 comments
Assignees
Labels
Meta response-ops-mx-backlog ResponseOps MX backlog Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@XavierM
Copy link
Contributor

XavierM commented Mar 1, 2022

As user, I would like to see logs related to my rules including execution, actions and query logs. We will use the kibana event log API to access all these logs.

We will add this different element in the rule details page

  1. Create two tabs for Alerts and Logs
  2. Add a KQL to allow filter on the table logs ON HOLD
  3. Need to be determined if it is feasible because there is a lot of discussion around status, but we can think about adding a skeleton element to add filter
  4. Add a date picker
  5. Add a button to allow refresh of the data
  6. Add a table will all the logs associated to the rule
  7. NICE TO HAVE -> Add an inspect button to show the request and the response from elastic search

Screen Shot 2022-03-01 at 12 52 09 PM

@XavierM XavierM added Meta Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) labels Mar 1, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

@gmmorris
Copy link
Contributor

gmmorris commented Mar 2, 2022

Reading the description above it looks like we're thinking this will display a line per rule execution, is that right?
It's important to note there are multiple events per execution, so some kind of aggregation would likely be needed here by the execution uuid (I think 🤔 ).

Worth discussing with @pmuellr before implementing

@XavierM
Copy link
Contributor Author

XavierM commented Mar 2, 2022

Reading the description above it looks like we're thinking this will display a line per rule execution, is that right? It's important to note there are multiple events per execution, so some kind of aggregation would likely be needed here by the execution uuid (I think 🤔 ).

Worth discussing with @pmuellr before implementing

Yes, we are aware and already talking to @ymao1 and future issue will be created to describe this work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Meta response-ops-mx-backlog ResponseOps MX backlog Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
No open projects
Development

No branches or pull requests

5 participants