[RAC] [Observability] Use simpler alert severity level mapping #109068

mgiota · 2021-08-18T10:10:59Z

📝 Summary

In order to comply with the Alerts-as-Data-Schema-Fields, we are removing kibana.alert.severity.level and kibana.alert.severity.value and keep only kibana.alert.severity.

Acceptance criteria

ALERT_SEVERITY_VALUE and all usages are removed for now
ALERT_SEVERITY_LEVEL is renamed to ALERT_SEVERITY and it will be a keyword field called kibana.alert.severity
the severity field will be hidden from the obs alert table and flyout (part of this PR [RAC][Observability] temporarily hide severity column #109004)
the discussion about storing the severity value will be deferred until we have time to gather wider input about the use-cases

Notes

This also lets us keep the schema consistent with existing security signals where they use signal.rule.severity and they would like to alias that field as kibana.alert.severity (as opposed to aliasing it as kibana.alert.severity.level).

…ERT_SEVERITY

…and shown in the Observability alerts table

elasticmachine · 2021-08-18T11:16:04Z

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

dominiqueclarke

Uptime changes LGTM

elasticmachine · 2021-08-18T13:10:59Z

Pinging @elastic/apm-ui (Team:apm)

elasticmachine · 2021-08-18T13:11:00Z

Pinging @elastic/uptime (Team:uptime)

mgiota · 2021-08-18T13:14:51Z

@elasticmachine merge upstream

justinkambic

Looks good, there's a commented line we should remove.

x-pack/plugins/uptime/server/lib/alerts/duration_anomaly.test.ts

Co-authored-by: Justin Kambic <justin.kambic@elastic.co>

x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts

smith

APM changes look good.

justinkambic

LGTM

kibanamachine · 2021-08-18T20:29:22Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`apm`	4.4MB	4.4MB	-366.0B
`observability`	490.5KB	490.0KB	-542.0B
`securitySolution`	6.5MB	6.5MB	-176.0B
`timelines`	437.5KB	436.8KB	-704.0B
total			-1.7KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`apm`	46.5KB	46.3KB	-194.0B
`infra`	149.7KB	149.5KB	-176.0B
`uptime`	36.6KB	36.5KB	-176.0B
total			-546.0B

History

💚 Build #146690 succeeded 87c3ce6
💚 Build #146624 succeeded 6360294
💔 Build #146603 failed 7d40bb9
💔 Build #146526 failed 5093150

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @mgiota

…ic#109068) * [RAC][Observability] remove severity fields from mapping keep only ALERT_SEVERITY * temporarily remove severity value occurences * remove ALERT_SEVERITY_VALUE occurences, this value is not being read and shown in the Observability alerts table * remove duplicate ALERT_SEVERITY identifier Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

kibanamachine · 2021-08-18T20:32:20Z

💚 Backport successful

Status	Branch	Result
✅	7.15
✅	7.x

The backport PRs will be merged automatically after passing CI.

…) (#109172) * [RAC][Observability] remove severity fields from mapping keep only ALERT_SEVERITY * temporarily remove severity value occurences * remove ALERT_SEVERITY_VALUE occurences, this value is not being read and shown in the Observability alerts table * remove duplicate ALERT_SEVERITY identifier Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: mgiota <giota85@gmail.com>

…) (#109171) * [RAC][Observability] remove severity fields from mapping keep only ALERT_SEVERITY * temporarily remove severity value occurences * remove ALERT_SEVERITY_VALUE occurences, this value is not being read and shown in the Observability alerts table * remove duplicate ALERT_SEVERITY identifier Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: mgiota <giota85@gmail.com>

mgiota changed the title ~~Severity column~~ [RAC][Observability] Index Severity for inventory threshold rule type Aug 18, 2021

mgiota mentioned this pull request Aug 18, 2021

[RAC][Observability] temporarily hide severity column #109004

Merged

mgiota force-pushed the severity_column branch 2 times, most recently from 0700540 to 1743e6e Compare August 18, 2021 10:53

mgiota added 2 commits August 18, 2021 12:57

[RAC][Observability] remove severity fields from mapping keep only AL…

4ad4b79

…ERT_SEVERITY

temporarily remove severity value occurences

a64b656

mgiota force-pushed the severity_column branch from 1743e6e to a64b656 Compare August 18, 2021 10:58

remove ALERT_SEVERITY_VALUE occurences, this value is not being read …

46b6201

…and shown in the Observability alerts table

mgiota changed the title ~~[RAC][Observability] Index Severity for inventory threshold rule type~~ [RAC][Observability] Use kibana.alert.severity instead of kibana.alert.severity.level Aug 18, 2021

mgiota marked this pull request as ready for review August 18, 2021 11:11

mgiota requested review from a team as code owners August 18, 2021 11:11

mgiota added the Team:Infra Monitoring UI - DEPRECATED DEPRECATED - Label for the Infra Monitoring UI team. Use Team:obs-ux-infra_services label Aug 18, 2021

mgiota added Theme: rac label obsolete v7.15.0 v8.0.0 auto-backport Deprecated - use backport:version if exact versions are needed labels Aug 18, 2021

mgiota changed the title ~~[RAC][Observability] Use kibana.alert.severity instead of kibana.alert.severity.level~~ [RAC][Observability] Comply with the Alerts-as-Data-Schema-Fields Aug 18, 2021

mgiota changed the title ~~[RAC][Observability] Comply with the Alerts-as-Data-Schema-Fields~~ [RAC][Observability] Comply with Alerts-as-Data-Schema-Fields spreadsheet Aug 18, 2021

mgiota changed the title ~~[RAC][Observability] Comply with Alerts-as-Data-Schema-Fields spreadsheet~~ [RAC][Observability] Comply with the Alerts-as-Data-Schema-Fields spreadsheet Aug 18, 2021

mgiota added the release_note:skip Skip the PR/issue when compiling release notes label Aug 18, 2021

weltenwort mentioned this pull request Aug 18, 2021

[RAC] 7.15 Observability Checklist #107933

Closed

52 tasks

mgiota self-assigned this Aug 18, 2021

weltenwort changed the title ~~[RAC][Observability] Comply with the Alerts-as-Data-Schema-Fields spreadsheet~~ [RAC] [Observability] Use simpler alert severity level mapping Aug 18, 2021

mgiota mentioned this pull request Aug 18, 2021

[Observability RAC] Severity column #108162

Closed

dominiqueclarke approved these changes Aug 18, 2021

View reviewed changes

botelastic bot added Team:APM All issues that need APM UI Team support Team:Uptime - DEPRECATED Synthetics & RUM sub-team of Application Observability labels Aug 18, 2021

kibanamachine and others added 2 commits August 18, 2021 09:14

Merge branch 'master' into severity_column

7d40bb9

remove duplicate ALERT_SEVERITY identifier

6360294

mgiota enabled auto-merge (squash) August 18, 2021 15:06

justinkambic reviewed Aug 18, 2021

View reviewed changes

x-pack/plugins/uptime/server/lib/alerts/duration_anomaly.test.ts Outdated Show resolved Hide resolved

mgiota and others added 2 commits August 18, 2021 18:18

Update x-pack/plugins/uptime/server/lib/alerts/duration_anomaly.test.ts

468892b

Co-authored-by: Justin Kambic <justin.kambic@elastic.co>

Merge branch 'master' of github.com:elastic/kibana into severity_column

87c3ce6

mgiota requested a review from justinkambic August 18, 2021 16:33

mistic added v7.16.0 and removed v7.15.0 labels Aug 18, 2021

weltenwort added bug Fixes for quality problems that affect the customer experience v7.15.0 labels Aug 18, 2021

smith reviewed Aug 18, 2021

View reviewed changes

x-pack/plugins/apm/server/lib/alerts/register_transaction_duration_anomaly_alert_type.ts Outdated Show resolved Hide resolved

smith approved these changes Aug 18, 2021

View reviewed changes

mgiota removed the request for review from justinkambic August 18, 2021 18:09

remove commented out alert_severity_value

72bccd9

justinkambic approved these changes Aug 18, 2021

View reviewed changes

mgiota merged commit 8c8dca6 into elastic:master Aug 18, 2021

kibanamachine mentioned this pull request Aug 18, 2021

[7.15] [RAC] [Observability] Use simpler alert severity level mapping (#109068) #109171

Merged

kibanamachine mentioned this pull request Aug 18, 2021

[7.x] [RAC] [Observability] Use simpler alert severity level mapping (#109068) #109172

Merged

mgiota deleted the severity_column branch January 4, 2022 10:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[RAC] [Observability] Use simpler alert severity level mapping #109068

[RAC] [Observability] Use simpler alert severity level mapping #109068

mgiota commented Aug 18, 2021 •

edited

Loading

elasticmachine commented Aug 18, 2021

dominiqueclarke left a comment •

edited

Loading

elasticmachine commented Aug 18, 2021

elasticmachine commented Aug 18, 2021

mgiota commented Aug 18, 2021

justinkambic left a comment

smith left a comment

justinkambic left a comment

kibanamachine commented Aug 18, 2021

kibanamachine commented Aug 18, 2021

[RAC] [Observability] Use simpler alert severity level mapping #109068

[RAC] [Observability] Use simpler alert severity level mapping #109068

Conversation

mgiota commented Aug 18, 2021 • edited Loading

📝 Summary

Acceptance criteria

Notes

elasticmachine commented Aug 18, 2021

dominiqueclarke left a comment • edited Loading

Choose a reason for hiding this comment

elasticmachine commented Aug 18, 2021

elasticmachine commented Aug 18, 2021

mgiota commented Aug 18, 2021

justinkambic left a comment

Choose a reason for hiding this comment

smith left a comment

Choose a reason for hiding this comment

justinkambic left a comment

Choose a reason for hiding this comment

kibanamachine commented Aug 18, 2021

💚 Build Succeeded

Metrics [docs]

Async chunks

Page load bundle

History

kibanamachine commented Aug 18, 2021

💚 Backport successful

mgiota commented Aug 18, 2021 •

edited

Loading

dominiqueclarke left a comment •

edited

Loading