Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bulk create, update, delete abilities for the rules client #53144

Closed
FrankHassanabad opened this issue Dec 16, 2019 · 4 comments
Closed

Bulk create, update, delete abilities for the rules client #53144

FrankHassanabad opened this issue Dec 16, 2019 · 4 comments
Labels
enhancement New value added to drive a business result estimate:medium Medium Estimated Level of Effort Feature:Alerting/RulesFramework Issues related to the Alerting Rules Framework Feature:Alerting NeededFor:Security Solution SIEM, Endpoint, Timeline, Analyzer, Cases Project:MoreRuleTypes Alerting team project for providing more ways to construct rules. Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@FrankHassanabad
Copy link
Contributor

FrankHassanabad commented Dec 16, 2019

Describe the feature:
Bulk rule management functions on the Alerting Framework RuleClient, including bulkGet, bulkCreate, etc. The bulk functions should share authorization logic across alerts to reduce the CPU load compared to repeated calls to the non-bulk analogous function.

Proposed bulkGet implementation: https://github.com/marshallmain/kibana/blob/rules-status-aggs/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts#L386-L433

Specific use case:
On the detection engine rules management page we display the status of each rule and refresh the statuses periodically. Our rule status API currently calls AlertsClient.get for each rule on the page to retrieve the alerting framework status for the rule. Even though we use async to make the calls to AlertsClient.get, there is significant CPU cost in the authorization logic of get and the CPU usage ends up becoming the dominant factor when fetching hundreds of alert statuses. A bulk function that can fetch multiple alerts while sharing the same authorization would allow our status route to be much faster.

Other bulk routes would be useful as well. bulkCreate in particular would have immediate applications for the detection engine, as we have a bulk create route that makes repeated calls to the AlertsClient.create function.

Original description **Describe the feature:** Bulk create, read, update, delete for alert client

Describe a specific use case for the feature:
Users with signals are doing bulk actions such as initializing pre-defined rules on the server and right now we do manual looping over the alert client to do these actions such as create, update, and delete.

We use find for bulk reads at the moment.

@FrankHassanabad FrankHassanabad added Feature:Alerting Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) labels Dec 16, 2019
@mikecote
Copy link
Contributor

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

@pmuellr
Copy link
Member

pmuellr commented Jul 6, 2020

We've also had requests for bulk fetching of alert state and alert status (not yet merged, but returns data from the event log).

As an example, see issue #70169 - the data for the pie chart at the top could be created from a bulk alert state request.

@FrankHassanabad
Copy link
Contributor Author

"Reviewed by Frank Hassanabad on 7/29/2020, still valid as of this date"

@gmmorris gmmorris added the NeededFor:Security Solution SIEM, Endpoint, Timeline, Analyzer, Cases label Jun 30, 2021
@gmmorris gmmorris changed the title Bulk create, update, delete abilities for the alert client Bulk create, update, delete abilities for the rules client Jun 30, 2021
@gmmorris gmmorris added Project:MoreRuleTypes Alerting team project for providing more ways to construct rules. Feature:Alerting/RulesFramework Issues related to the Alerting Rules Framework labels Jun 30, 2021
@gmmorris gmmorris added the loe:large Large Level of Effort label Jul 14, 2021
@gmmorris gmmorris added enhancement New value added to drive a business result estimate:medium Medium Estimated Level of Effort labels Aug 13, 2021
@gmmorris gmmorris removed the loe:large Large Level of Effort label Sep 2, 2021
@kobelb kobelb added the needs-team Issues missing a team label label Jan 31, 2022
@botelastic botelastic bot removed the needs-team Issues missing a team label label Jan 31, 2022
@XavierM
Copy link
Contributor

XavierM commented Mar 3, 2022

we are doing bulk update with this ticket -> #124715

@FrankHassanabad FrankHassanabad closed this as not planned Won't fix, can't repro, duplicate, stale Feb 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New value added to drive a business result estimate:medium Medium Estimated Level of Effort Feature:Alerting/RulesFramework Issues related to the Alerting Rules Framework Feature:Alerting NeededFor:Security Solution SIEM, Endpoint, Timeline, Analyzer, Cases Project:MoreRuleTypes Alerting team project for providing more ways to construct rules. Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
No open projects
Development

No branches or pull requests

6 participants