[RAM] Update rule status

x-pack/plugins/alerting/common/rule.ts

@@ -32,6 +32,9 @@ export const RuleExecutionStatusValues = [
 ] as const;
 export type RuleExecutionStatuses = typeof RuleExecutionStatusValues[number];
 
+export const RuleLastRunOutcomeValues = ['succeeded', 'warning', 'failed'] as const;
+export type RuleLastRunOutcomes = typeof RuleLastRunOutcomeValues[number];
+
 export enum RuleExecutionStatusErrorReasons {
   Read = 'read',
   Decrypt = 'decrypt',
@@ -76,12 +79,25 @@ export interface RuleAction {
 
 export interface RuleAggregations {
   alertExecutionStatus: { [status: string]: number };
+  ruleLastRunOutcome: { [status: string]: number };
   ruleEnabledStatus: { enabled: number; disabled: number };
   ruleMutedStatus: { muted: number; unmuted: number };
   ruleSnoozedStatus: { snoozed: number };
   ruleTags: string[];
 }
 
+export interface RuleLastRun {
+  outcome: RuleLastRunOutcomes;
+  warning?: RuleExecutionStatusErrorReasons | RuleExecutionStatusWarningReasons | null;
+  outcomeMsg?: string | null;
+  alertsCount: {
+    active?: number | null;
+    new?: number | null;
+    recovered?: number | null;
+    ignored?: number | null;
+  };
+}
+
 export interface MappedParamsProperties {
   risk_score?: number;
   severity?: string;
@@ -116,6 +132,9 @@ export interface Rule<Params extends RuleTypeParams = never> {
   snoozeSchedule?: RuleSnooze; // Remove ? when this parameter is made available in the public API
   activeSnoozes?: string[];
   isSnoozedUntil?: Date | null;
+  lastRun?: RuleLastRun | null;
+  nextRun?: Date | null;
+  running: boolean;
 }
 
 export type SanitizedRule<Params extends RuleTypeParams = never> = Omit<Rule<Params>, 'apiKey'>;
@@ -174,16 +193,34 @@ export interface RuleMonitoringHistory extends SavedObjectAttributes {
   success: boolean;
   timestamp: number;
   duration?: number;
+  outcome?: RuleLastRunOutcomes;
+}
+
+export interface RuleMonitoringCalculatedMetrics extends SavedObjectAttributes {
+  p50?: number;
+  p95?: number;
+  p99?: number;
+  success_ratio: number;
+}
+
+export interface RuleMonitoringLastRunMetrics extends SavedObjectAttributes {
+  duration: number;
+  total_search_duration_ms?: number | null;
+  total_indexing_duration_ms?: number | null;
+  total_alerts_detected?: number | null;
+  total_alerts_created?: number | null;
+  gap_duration_s?: number | null;
+}
+
+export interface RuleMonitoringLastRun extends SavedObjectAttributes {
+  timestamp: string;
+  metrics: RuleMonitoringLastRunMetrics;
 }
 
-export interface RuleMonitoring extends SavedObjectAttributes {
-  execution: {
+export interface RuleMonitoring {
+  run: {
     history: RuleMonitoringHistory[];
-    calculated_metrics: {
-      p50?: number;
-      p95?: number;
-      p99?: number;
-      success_ratio: number;
-    };
+    calculated_metrics: RuleMonitoringCalculatedMetrics;
+    last_run: RuleMonitoringLastRun;
   };
 }

x-pack/plugins/alerting/public/alert_api.test.ts

@@ -131,6 +131,7 @@ describe('loadRule', () => {
         "params": Object {
           "x": 42,
         },
+        "running": false,
         "schedule": Object {
           "interval": "1s",
         },
@@ -289,6 +290,7 @@ function getApiRule() {
       last_execution_date: RuleExecuteDate.toISOString(),
       last_duration: 1194,
     },
+    running: false,
   };
 }
 
@@ -330,5 +332,6 @@ function getRule(): Rule<{ x: number }> {
       lastExecutionDate: RuleExecuteDate,
       lastDuration: 1194,
     },
+    running: false,
   };
 }

x-pack/plugins/alerting/public/lib/common_transformations.test.ts

@@ -54,6 +54,7 @@ describe('common_transformations', () => {
           message: 'this is just a test',
         },
       },
+      running: false,
     };
     expect(transformRule(apiRule)).toMatchInlineSnapshot(`
       Object {
@@ -105,6 +106,7 @@ describe('common_transformations', () => {
             ],
           },
         },
+        "running": false,
         "schedule": Object {
           "interval": "1s",
         },
@@ -152,6 +154,7 @@ describe('common_transformations', () => {
         last_execution_date: dateExecuted.toISOString(),
         status: 'error',
       },
+      running: false,
     };
     expect(transformRule(apiRule)).toMatchInlineSnapshot(`
       Object {
@@ -184,6 +187,7 @@ describe('common_transformations', () => {
         "name": "some-name",
         "notifyWhen": "onActiveAlert",
         "params": Object {},
+        "running": false,
         "schedule": Object {
           "interval": "1s",
         },

x-pack/plugins/alerting/public/lib/common_transformations.ts

@@ -5,7 +5,14 @@
  * 2.0.
  */
 import { AsApiContract } from '@kbn/actions-plugin/common';
-import { RuleExecutionStatus, Rule, RuleAction, RuleType } from '../../common';
+import {
+  RuleExecutionStatus,
+  RuleMonitoring,
+  Rule,
+  RuleLastRun,
+  RuleAction,
+  RuleType,
+} from '../../common';
 
 function transformAction(input: AsApiContract<RuleAction>): RuleAction {
   const { connector_type_id: actionTypeId, ...rest } = input;
@@ -27,6 +34,31 @@ function transformExecutionStatus(input: ApiRuleExecutionStatus): RuleExecutionS
   };
 }
 
+function transformMonitoring(input: RuleMonitoring): RuleMonitoring {
+  const { run } = input;
+  const { last_run: lastRun, ...rest } = run;
+  const { timestamp, ...restLastRun } = lastRun;
+
+  return {
+    run: {
+      last_run: {
+        timestamp: input.run.last_run.timestamp,
+        ...restLastRun,
+      },
+      ...rest,
+    },
+  };
+}
+
+function transformLastRun(input: AsApiContract<RuleLastRun>): RuleLastRun {
+  const { outcome_msg: outcomeMsg, alerts_count: alertsCount, ...rest } = input;
+  return {
+    outcomeMsg,
+    alertsCount,
+    ...rest,
+  };
+}
+
 // AsApiContract does not deal with object properties that also
 // need snake -> camel conversion, Dates, are renamed, etc, so we do by hand
 export type ApiRule = Omit<
@@ -37,13 +69,15 @@ export type ApiRule = Omit<
   | 'updated_at'
   | 'alert_type_id'
   | 'muted_instance_ids'
+  | 'last_run'
 > & {
   execution_status: ApiRuleExecutionStatus;
   actions: Array<AsApiContract<RuleAction>>;
   created_at: string;
   updated_at: string;
   rule_type_id: string;
   muted_alert_ids: string[];
+  last_run?: AsApiContract<RuleLastRun>;
 };
 
 export function transformRule(input: ApiRule): Rule {
@@ -61,6 +95,9 @@ export function transformRule(input: ApiRule): Rule {
     scheduled_task_id: scheduledTaskId,
     execution_status: executionStatusAPI,
     actions: actionsAPI,
+    next_run: nextRun,
+    last_run: lastRun,
+    monitoring: monitoring,
     ...rest
   } = input;
 
@@ -78,6 +115,9 @@ export function transformRule(input: ApiRule): Rule {
     executionStatus: transformExecutionStatus(executionStatusAPI),
     actions: actionsAPI ? actionsAPI.map((action) => transformAction(action)) : [],
     scheduledTaskId,
+    ...(nextRun ? { nextRun: new Date(nextRun) } : {}),
+    ...(monitoring ? { monitoring: transformMonitoring(monitoring) } : {}),
+    ...(lastRun ? { lastRun: transformLastRun(lastRun) } : {}),
     ...rest,
   };
 }

x-pack/plugins/alerting/server/lib/alert_summary_from_event_log.test.ts

@@ -730,4 +730,5 @@ const BaseRule: SanitizedRule<{ bar: boolean }> = {
     status: 'unknown',
     lastExecutionDate: new Date('2020-08-20T19:23:38Z'),
   },
+  running: false,
 };

x-pack/plugins/alerting/server/lib/index.ts

@@ -25,6 +25,13 @@ export {
   ruleExecutionStatusToRaw,
   ruleExecutionStatusFromRaw,
 } from './rule_execution_status';
+export { lastRunFromState, lastRunFromError, lastRunToRaw } from './last_run_status';
+export {
+  updateMonitoring,
+  getDefaultMonitoring,
+  convertMonitoringFromRawAndVerify,
+} from './monitoring';
+export { getNextRunDate, getNextRunString } from './next_run';
 export { processAlerts } from './process_alerts';
 export { createWrappedScopedClusterClientFactory } from './wrap_scoped_cluster_client';
 export { isRuleSnoozed, getRuleSnoozeEndTime } from './is_rule_snoozed';

x-pack/plugins/alerting/server/lib/last_run_status.ts

@@ -0,0 +1,87 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { RuleTaskStateAndMetrics } from '../task_runner/types';
+import { getReasonFromError } from './error_with_reason';
+import { getEsErrorMessage } from './errors';
+import { ActionsCompletion } from '../../common';
+import {
+  RuleLastRunOutcomeValues,
+  RuleLastRunOutcomes,
+  RuleExecutionStatusWarningReasons,
+  RawRuleLastRun,
+  RuleLastRun,
+} from '../types';
+import { translations } from '../constants/translations';
+import { RuleRunMetrics } from './rule_run_metrics_store';
+
+export interface ILastRun {
+  lastRun: RuleLastRun;
+  metrics: RuleRunMetrics | null;
+}
+
+export const lastRunFromState = (stateWithMetrics: RuleTaskStateAndMetrics): ILastRun => {
+  const { metrics } = stateWithMetrics;
+  let outcome: RuleLastRunOutcomes = RuleLastRunOutcomeValues[0];
+  // Check for warning states
+  let warning = null;
+  let outcomeMsg = null;
+
+  // We only have a single warning field so prioritizing the alert circuit breaker over the actions circuit breaker
+  if (metrics.hasReachedAlertLimit) {
+    outcome = RuleLastRunOutcomeValues[1];
+    warning = RuleExecutionStatusWarningReasons.MAX_ALERTS;
+    outcomeMsg = translations.taskRunner.warning.maxAlerts;
+  } else if (metrics.triggeredActionsStatus === ActionsCompletion.PARTIAL) {
+    outcome = RuleLastRunOutcomeValues[1];
+    warning = RuleExecutionStatusWarningReasons.MAX_EXECUTABLE_ACTIONS;
+    outcomeMsg = translations.taskRunner.warning.maxExecutableActions;
+  }
+
+  return {
+    lastRun: {
+      outcome,
+      alertsCount: {
+        active: metrics.numberOfActiveAlerts,
+        new: metrics.numberOfNewAlerts,
+        recovered: metrics.numberOfRecoveredAlerts,
+        ignored: 0,
+      },
+      ...(warning ? { warning } : {}),
+      ...(outcomeMsg ? { outcome_msg: outcomeMsg } : {}),
+    },
+    metrics,
+  };
+};
+
+export const lastRunFromError = (error: Error): ILastRun => {
+  return {
+    lastRun: {
+      outcome: RuleLastRunOutcomeValues[2],
+      warning: getReasonFromError(error),
+      outcomeMsg: getEsErrorMessage(error),
+      alertsCount: {},
+    },
+    metrics: null,
+  };
+};
+
+export const lastRunToRaw = (lastRun: ILastRun['lastRun']): RawRuleLastRun => {
+  const { warning, alertsCount, outcomeMsg } = lastRun;
+
+  return {
+    ...lastRun,
+    alertsCount: {
+      active: alertsCount.active || 0,
+      new: alertsCount.new || 0,
+      recovered: alertsCount.recovered || 0,
+      ignored: alertsCount.ignored || 0,
+    },
+    warning: warning ?? null,
+    outcomeMsg: outcomeMsg ?? null,
+  };
+};

x-pack/plugins/alerting/server/lib/monitoring.test.ts

@@ -42,7 +42,7 @@ const mockHistory = [
 ];
 
 const mockRuleMonitoring = {
-  execution: {
+  run: {
     history: mockHistory,
     calculated_metrics: {
       success_ratio: 0,
@@ -52,7 +52,7 @@ const mockRuleMonitoring = {
 
 describe('getExecutionDurationPercentiles', () => {
   it('Calculates the percentile given partly undefined durations', () => {
-    const percentiles = getExecutionDurationPercentiles(mockRuleMonitoring);
+    const percentiles = getExecutionDurationPercentiles(mockRuleMonitoring.run.history);
     expect(percentiles.p50).toEqual(250);
     expect(percentiles.p95).toEqual(500);
     expect(percentiles.p99).toEqual(500);
@@ -66,13 +66,13 @@ describe('getExecutionDurationPercentiles', () => {
 
     const newMockRuleMonitoring = {
       ...mockRuleMonitoring,
-      execution: {
-        ...mockRuleMonitoring.execution,
+      run: {
+        ...mockRuleMonitoring.run,
         history: nullDurationHistory,
       },
     } as RuleMonitoring;
 
-    const percentiles = getExecutionDurationPercentiles(newMockRuleMonitoring);
+    const percentiles = getExecutionDurationPercentiles(newMockRuleMonitoring.run.history);
     expect(Object.keys(percentiles).length).toEqual(0);
   });
 });