[RAC] ALerts table in observability #103270

XavierM · 2021-06-24T13:12:27Z

Summary

Add alerts table in Observability =>

Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release.

When forming the risk matrix, consider some of the following examples and how they may potentially impact the change:

Risk	Probability	Severity	Mitigation/Notes
Multiple Spaces—unexpected behavior in non-default Kibana Space.	Low	High	Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces.
Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks.	High	Low	Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure.
Code should gracefully handle cases when feature X or plugin Y are disabled.	Medium	High	Unit tests will verify that any feature flag or plugin combination still results in our service operational.
See more potential risk examples

For maintainers

This was checked for breaking API changes and was labeled appropriately

…-in-obs

elasticmachine · 2021-06-29T20:02:45Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

katrin-freihofner · 2021-07-01T12:43:46Z

UX improvements

Duration column should be right-aligned.
Units in the duration column should be abbreviated
Severity should not be unknown (suggestions to use critical if unknown)
The reason should use up the full width available
Actions (very left column) should have a headline Actions
The number of rows and pagination is not as designed cc @mdefazio
Do we need the experimental badge and callout?
I don't think the placeholder text in the search box is a great example of what to search for

cc @jasonrhodes @cyrille-leclerc @weltenwort @mgiota

XavierM · 2021-07-01T17:28:00Z

UX improvements

Duration column should be right-aligned.

Units in the duration column should be abbreviated

Severity should not be unknown (suggestions to use critical if unknown)

The reason should use up the full width available

Actions (very left column) should have a headline Actions

The number of rows and pagination is not as designed cc @mdefazio

Do we need the experimental badge and callout?

I don't think the placeholder text in the search box is a great example of what to search for

cc @jasonrhodes @cyrille-leclerc @weltenwort @mgiota

Noted ❤️ , but this PR is not the final product because we are still using t-grid and the team are in work to convert t-grid with EuiDatagrid. This PR will help to see integration/improvement on the Alert table when it is merged with new updates.

andrew-goldstein

The All view isn't showing any alerts when it's selected:

andrew-goldstein · 2021-07-01T19:43:46Z

x-pack/plugins/rule_registry/common/field_map/runtime_type_from_fieldmap.ts

-  float: t.number,
-  scaled_float: t.number,
-  unsigned_long: t.number,
+  boolean: t.union([t.number, BooleanFromString]),


Would using t.boolean instead of t.number, e.g:

t.union([t.boolean, BooleanFromString])

make sense here?

bad copy pasta, thank you!

XavierM · 2021-07-01T21:15:11Z

The All view isn't showing any alerts when it's selected:

That's correct, I forget to remove the all button. In one of the RAC UX experience, they decided to not have the all functionality to simplify the bulk update alerts.

andrew-goldstein · 2021-07-01T21:22:48Z

x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx

+      rowCellRender: ({ data }: ActionProps) => {
+        const dataFieldEs = data.reduce((acc, d) => ({ ...acc, [d.field]: d.value }), {});
+        const decoratedAlerts = decorateResponse(
+          [dataFieldEs] ?? [],


nit: is the ?? [] still required here (and here)?

andrew-goldstein · 2021-07-01T21:34:10Z

x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid_actions.tsx

+        }
+        closePopover={() => setIsPopoverOpen(false)}
+      >
+        <EuiPopoverTitle>Actions</EuiPopoverTitle>


consider creating an i18n for this

andrew-goldstein · 2021-07-01T21:35:17Z

x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid_actions.tsx

+          <EuiButtonEmpty href={prepend(link ?? '')}>
+            <EuiFlexGroup alignItems="center" component="span" gutterSize="s">
+              <EuiFlexItem grow={false}>
+                <EuiButtonIcon aria-label="view in app" iconType="link" color="text" />


consider using an i18n for the aria-label
EDIT: and here

andrew-goldstein

Thanks for moving this forward @XavierM! 🙏
left just a few minor comments
LGTM from the t-grid side

weltenwort

Thanks for putting this together. As it is the table should be sufficient to check that the observability solution are poperly registering their lifecycle alerts. 👍

Given the list of UX problems already enumerated by @katrin-freihofner we wouldn't want to release it like this. But assuming the <EuiDataGrid>-based implementation is merged soon it seems wasteful to make extensive changes here.

weltenwort · 2021-07-05T11:14:19Z

x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx

+        setRefetch,
+        sort: [
+          {
+            columnId: '@timestamp',


This essentially means "sort by last update", which might not be intuitive to the user. How about we sort by "triggered" (kibana.rac.alert.start) instead?

Suggested change

columnId: '@timestamp',

columnId: 'kibana.rac.alert.start',

weltenwort · 2021-07-05T11:14:22Z

x-pack/plugins/observability/public/pages/alerts/alerts_table_t_grid.tsx

+        return (
+          <EuiButtonIcon
+            size="s"
+            target="_blank"


What's the intention behind opening in a new tab here? Shouldn't that be up to the user?

andrew-goldstein · 2021-07-06T14:12:25Z

@elasticmachine merge upstream

kibanamachine · 2021-07-06T16:21:11Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`observability`	248	249	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`apm`	4.3MB	4.3MB	+1.5KB
`observability`	478.9KB	483.4KB	+4.5KB
`securitySolution`	6.3MB	6.3MB	+103.0B
`timelines`	265.6KB	266.0KB	+385.0B
total			+6.4KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`observability`	55.3KB	54.9KB	-481.0B
`timelines`	210.1KB	210.2KB	+107.0B
total			-374.0B

Unknown metric groups

References to deprecated APIs

id	before	after	diff
`observability`	14	18	+4

History

💚 Build #135709 succeeded b550ab4
💚 Build #135609 succeeded 3766261
💔 Build #135314 failed 13e8561
💔 Build #135289 failed b038ad4
💔 Build #135265 failed f28f717

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

Closes elastic#98611 ## Summary Add alerts table in Observability => ![image](https://user-images.githubusercontent.com/189600/123854490-c68ddf00-d8ec-11eb-897e-2217249d5fba.png) ### Risk Matrix Delete this section if it is not applicable to this PR. Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release. When forming the risk matrix, consider some of the following examples and how they may potentially impact the change: | Risk | Probability | Severity | Mitigation/Notes | |---------------------------|-------------|----------|-------------------------| | Multiple Spaces—unexpected behavior in non-default Kibana Space. | Low | High | Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces. | | Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks. | High | Low | Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure. | | Code should gracefully handle cases when feature X or plugin Y are disabled. | Medium | High | Unit tests will verify that any feature flag or plugin combination still results in our service operational. | | [See more potential risk examples](https://github.com/elastic/kibana/blob/master/RISK_MATRIX.mdx) | ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

Closes #98611 ## Summary Add alerts table in Observability => ![image](https://user-images.githubusercontent.com/189600/123854490-c68ddf00-d8ec-11eb-897e-2217249d5fba.png) ### Risk Matrix Delete this section if it is not applicable to this PR. Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release. When forming the risk matrix, consider some of the following examples and how they may potentially impact the change: | Risk | Probability | Severity | Mitigation/Notes | |---------------------------|-------------|----------|-------------------------| | Multiple Spaces—unexpected behavior in non-default Kibana Space. | Low | High | Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces. | | Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks. | High | Low | Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure. | | Code should gracefully handle cases when feature X or plugin Y are disabled. | Medium | High | Unit tests will verify that any feature flag or plugin combination still results in our service operational. | | [See more potential risk examples](https://github.com/elastic/kibana/blob/master/RISK_MATRIX.mdx) | ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) Co-authored-by: Xavier Mouligneau <189600+XavierM@users.noreply.github.com>

Closes elastic#98611 ## Summary Add alerts table in Observability => ![image](https://user-images.githubusercontent.com/189600/123854490-c68ddf00-d8ec-11eb-897e-2217249d5fba.png) ### Risk Matrix Delete this section if it is not applicable to this PR. Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release. When forming the risk matrix, consider some of the following examples and how they may potentially impact the change: | Risk | Probability | Severity | Mitigation/Notes | |---------------------------|-------------|----------|-------------------------| | Multiple Spaces—unexpected behavior in non-default Kibana Space. | Low | High | Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces. | | Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks. | High | Low | Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure. | | Code should gracefully handle cases when feature X or plugin Y are disabled. | Medium | High | Unit tests will verify that any feature flag or plugin combination still results in our service operational. | | [See more potential risk examples](https://github.com/elastic/kibana/blob/master/RISK_MATRIX.mdx) | ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

wip

fd7ec5c

XavierM added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes v7.15.0 labels Jun 24, 2021

XavierM requested a review from a team as a code owner June 24, 2021 13:12

kqualters-elastic and others added 10 commits June 28, 2021 14:57

WIP debugging timelineById state

4e2dc7b

Provide default value for selectedEventIds

ea8c65c

Merge remote-tracking branch 'upstream/master' into t-grid-in-obs

04ad0be

Merge branch 'master' of github.com:elastic/kibana into t-grid-in-obs

09b6708

Show inspect only on hover, remove debugging code

f28f717

stop rebuilding store + adapt to new obs code

039895e

Merge branch 't-grid-in-obs' of github.com:XavierM/kibana into t-grid…

b038ad4

…-in-obs

add reftech

25b696a

get dynamic index patterns

94ed105

Merge branch 'master' of github.com:elastic/kibana into t-grid-in-obs

13e8561

XavierM added the Team:Threat Hunting Security Solution Threat Hunting Team label Jun 29, 2021

XavierM added 2 commits June 30, 2021 10:26

fix types

68fd6c3

Merge branch 'master' of github.com:elastic/kibana into t-grid-in-obs

3766261

XavierM requested a review from a team as a code owner June 30, 2021 14:27

clean up

b550ab4

andrew-goldstein reviewed Jul 1, 2021

View reviewed changes

andrew-goldstein approved these changes Jul 1, 2021

View reviewed changes

jasonrhodes mentioned this pull request Jul 4, 2021

[RAC] UX improvements for 7.15 alerts table in observability #104269

Closed

weltenwort self-requested a review July 5, 2021 09:38

weltenwort approved these changes Jul 5, 2021

View reviewed changes

Merge branch 'master' into t-grid-in-obs

1cb0ecb

andrew-goldstein merged commit cf9e88c into elastic:master Jul 6, 2021

andrew-goldstein deleted the t-grid-in-obs branch July 6, 2021 16:28

andrew-goldstein mentioned this pull request Jul 6, 2021

[7.x] [RAC] ALerts table in observability (#103270) #104500

Merged

arisonl mentioned this pull request Jul 9, 2021

Visual indication for disabled or muted alerts #80310

Closed

This was referenced Jul 12, 2021

[Observability RAC] Improve alerts table columns #105227

Closed

[Observability RAC] Align the alerts table pagination with the envisioned designs #105229

Closed

YulNaumenko mentioned this pull request Jul 20, 2021

Rename the rule Active status to Triggered. #106281

Open

peluja1012 mentioned this pull request Oct 26, 2021

[RAC][Alert Triage] Alerts Table Component #93873

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[RAC] ALerts table in observability #103270

[RAC] ALerts table in observability #103270

XavierM commented Jun 24, 2021 •

edited by jasonrhodes

Loading

elasticmachine commented Jun 29, 2021

katrin-freihofner commented Jul 1, 2021 •

edited by andrew-goldstein

Loading

XavierM commented Jul 1, 2021

UX improvements

andrew-goldstein left a comment

andrew-goldstein Jul 1, 2021

XavierM Jul 1, 2021

XavierM commented Jul 1, 2021

andrew-goldstein Jul 1, 2021

andrew-goldstein Jul 1, 2021

andrew-goldstein Jul 1, 2021 •

edited

Loading

andrew-goldstein left a comment

weltenwort left a comment

weltenwort Jul 5, 2021

weltenwort Jul 5, 2021

andrew-goldstein commented Jul 6, 2021

kibanamachine commented Jul 6, 2021

References to deprecated APIs

[RAC] ALerts table in observability #103270

[RAC] ALerts table in observability #103270

Conversation

XavierM commented Jun 24, 2021 • edited by jasonrhodes Loading

Summary

Risk Matrix

For maintainers

elasticmachine commented Jun 29, 2021

katrin-freihofner commented Jul 1, 2021 • edited by andrew-goldstein Loading

UX improvements

XavierM commented Jul 1, 2021

UX improvements

andrew-goldstein left a comment

Choose a reason for hiding this comment

andrew-goldstein Jul 1, 2021

Choose a reason for hiding this comment

XavierM Jul 1, 2021

Choose a reason for hiding this comment

XavierM commented Jul 1, 2021

andrew-goldstein Jul 1, 2021

Choose a reason for hiding this comment

andrew-goldstein Jul 1, 2021

Choose a reason for hiding this comment

andrew-goldstein Jul 1, 2021 • edited Loading

Choose a reason for hiding this comment

andrew-goldstein left a comment

Choose a reason for hiding this comment

weltenwort left a comment

Choose a reason for hiding this comment

weltenwort Jul 5, 2021

Choose a reason for hiding this comment

weltenwort Jul 5, 2021

Choose a reason for hiding this comment

andrew-goldstein commented Jul 6, 2021

kibanamachine commented Jul 6, 2021

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Page load bundle

References to deprecated APIs

History

XavierM commented Jun 24, 2021 •

edited by jasonrhodes

Loading

katrin-freihofner commented Jul 1, 2021 •

edited by andrew-goldstein

Loading

andrew-goldstein Jul 1, 2021 •

edited

Loading