Updating tests

elastic · Jan 30, 2024 · 468f94d · 468f94d
1 parent 9f3575a
commit 468f94d
Show file tree

Hide file tree

Showing 10 changed files with 787 additions and 132 deletions.
diff --git a/x-pack/plugins/alerting/server/alerts_client/lib/format_rule.test.ts b/x-pack/plugins/alerting/server/alerts_client/lib/format_rule.test.ts
@@ -61,6 +61,7 @@ describe('formatRule', () => {
           revision: 0,
           spaceId: 'default',
           tags: ['rule-', '-tags'],
+          alertDelay: 0,
         },
         ruleType,
       })

diff --git a/x-pack/plugins/alerting/server/alerts_service/alerts_service.test.ts b/x-pack/plugins/alerting/server/alerts_service/alerts_service.test.ts
@@ -1475,6 +1475,7 @@ describe('Alerts Service', () => {
               revision: 0,
               spaceId: 'default',
               tags: ['rule-', '-tags'],
+              alertDelay: 0,
             },
           });
 
@@ -1495,6 +1496,7 @@ describe('Alerts Service', () => {
               revision: 0,
               spaceId: 'default',
               tags: ['rule-', '-tags'],
+              alertDelay: 0,
             },
             kibanaVersion: '8.8.0',
           });
@@ -1528,6 +1530,7 @@ describe('Alerts Service', () => {
               revision: 0,
               spaceId: 'default',
               tags: ['rule-', '-tags'],
+              alertDelay: 0,
             },
           });
 
@@ -1576,6 +1579,7 @@ describe('Alerts Service', () => {
               revision: 0,
               spaceId: 'default',
               tags: ['rule-', '-tags'],
+              alertDelay: 0,
             },
           });
 
@@ -1674,6 +1678,7 @@ describe('Alerts Service', () => {
                 revision: 0,
                 spaceId: 'default',
                 tags: ['rule-', '-tags'],
+                alertDelay: 0,
               },
             }),
             alertsService.createAlertsClient({
@@ -1691,6 +1696,7 @@ describe('Alerts Service', () => {
                 revision: 0,
                 spaceId: 'default',
                 tags: ['rule-', '-tags'],
+                alertDelay: 0,
               },
             }),
           ]);
@@ -1781,6 +1787,7 @@ describe('Alerts Service', () => {
               revision: 0,
               spaceId: 'default',
               tags: ['rule-', '-tags'],
+              alertDelay: 0,
             },
           });
 
@@ -1801,6 +1808,7 @@ describe('Alerts Service', () => {
               revision: 0,
               spaceId: 'default',
               tags: ['rule-', '-tags'],
+              alertDelay: 0,
             },
             kibanaVersion: '8.8.0',
           });
@@ -1865,6 +1873,7 @@ describe('Alerts Service', () => {
                 revision: 0,
                 spaceId: 'default',
                 tags: ['rule-', '-tags'],
+                alertDelay: 0,
               },
             });
           };
@@ -1961,6 +1970,7 @@ describe('Alerts Service', () => {
                 revision: 0,
                 spaceId: 'default',
                 tags: ['rule-', '-tags'],
+                alertDelay: 0,
               },
             });
           };
@@ -2026,6 +2036,7 @@ describe('Alerts Service', () => {
               revision: 0,
               spaceId: 'default',
               tags: ['rule-', '-tags'],
+              alertDelay: 0,
             },
           });
 
@@ -2091,6 +2102,7 @@ describe('Alerts Service', () => {
               revision: 0,
               spaceId: 'default',
               tags: ['rule-', '-tags'],
+              alertDelay: 0,
             },
           });
 
@@ -2154,6 +2166,7 @@ describe('Alerts Service', () => {
               revision: 0,
               spaceId: 'default',
               tags: ['rule-', '-tags'],
+              alertDelay: 0,
             },
           });
 

diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.ts
@@ -312,6 +312,7 @@ export class TaskRunner<
       muteAll,
       revision,
       snoozeSchedule,
+      alertDelay,
     } = rule;
     const {
       params: { alertId: ruleId, spaceId },
@@ -526,6 +527,7 @@ export class TaskRunner<
                 notifyWhen,
                 muteAll,
                 snoozeSchedule,
+                alertDelay,
               },
               logger: this.logger,
               flappingSettings,
@@ -583,7 +585,7 @@ export class TaskRunner<
           notifyWhen === RuleNotifyWhen.CHANGE ||
           some(actions, (action) => action.frequency?.notifyWhen === RuleNotifyWhen.CHANGE),
         maintenanceWindowIds: maintenanceWindowsWithoutScopedQueryIds,
-        alertDelay: rule.alertDelay?.active ?? 0,
+        alertDelay: alertDelay?.active ?? 0,
       });
     });
 

diff --git a/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts b/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.ts
@@ -351,12 +351,11 @@ export const createLifecycleExecutor =
     const newEventsToIndex = makeEventsDataMapFor(newAlertIds);
     const trackedRecoveredEventsToIndex = makeEventsDataMapFor(trackedAlertRecoveredIds);
     const allEventsToIndex = getAlertsForNotification(
-      commonRuleFields[TIMESTAMP],
       flappingSettings,
       rule.alertDelay?.active ?? 0,
       trackedEventsToIndex,
       newEventsToIndex,
-      maintenanceWindowIds
+      { maintenanceWindowIds, timestamp: commonRuleFields[TIMESTAMP] }
     );
 
     // Only write alerts if:
@@ -398,7 +397,7 @@ export const createLifecycleExecutor =
     }
 
     const nextTrackedAlerts = Object.fromEntries(
-      [...allEventsToIndex, ...trackedEventsToIndex]
+      [...newEventsToIndex, ...trackedEventsToIndex]
         .filter(({ event }) => event[ALERT_STATUS] !== ALERT_STATUS_RECOVERED)
         .map(
           ({

diff --git a/x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.test.ts b/x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.test.ts
@@ -14,6 +14,10 @@ import { cloneDeep } from 'lodash';
 import { getAlertsForNotification } from './get_alerts_for_notification';
 
 describe('getAlertsForNotification', () => {
+  const newEventParams = {
+    maintenanceWindowIds: ['maintenance-window-id'],
+    timestamp: 'timestamp',
+  };
   const alert1 = {
     event: {
       'kibana.alert.status': ALERT_STATUS_RECOVERED,
@@ -54,7 +58,13 @@ describe('getAlertsForNotification', () => {
     const trackedEvents = cloneDeep([alert4]);
     const newEvents = cloneDeep([alert5]);
     expect(
-      getAlertsForNotification('timestamp', DEFAULT_FLAPPING_SETTINGS, 0, trackedEvents, newEvents)
+      getAlertsForNotification(
+        DEFAULT_FLAPPING_SETTINGS,
+        0,
+        trackedEvents,
+        newEvents,
+        newEventParams
+      )
     ).toMatchInlineSnapshot(`
       Array [
         Object {
@@ -82,8 +92,9 @@ describe('getAlertsForNotification', () => {
 
   test('should not remove alerts if the num of recovered alerts is not at the limit', () => {
     const trackedEvents = cloneDeep([alert1, alert2, alert3]);
-    expect(getAlertsForNotification('timestamp', DEFAULT_FLAPPING_SETTINGS, 0, trackedEvents, []))
-      .toMatchInlineSnapshot(`
+    expect(
+      getAlertsForNotification(DEFAULT_FLAPPING_SETTINGS, 0, trackedEvents, [], newEventParams)
+    ).toMatchInlineSnapshot(`
       Array [
         Object {
           "activeCount": 0,
@@ -115,8 +126,9 @@ describe('getAlertsForNotification', () => {
 
   test('should reset counts and not modify alerts if flapping is disabled', () => {
     const trackedEvents = cloneDeep([alert1, alert2, alert3]);
-    expect(getAlertsForNotification('timestamp', DISABLE_FLAPPING_SETTINGS, 0, trackedEvents, []))
-      .toMatchInlineSnapshot(`
+    expect(
+      getAlertsForNotification(DISABLE_FLAPPING_SETTINGS, 0, trackedEvents, [], newEventParams)
+    ).toMatchInlineSnapshot(`
       Array [
         Object {
           "activeCount": 0,
@@ -150,7 +162,13 @@ describe('getAlertsForNotification', () => {
     const trackedEvents = cloneDeep([alert4]);
     const newEvents = cloneDeep([alert5]);
     expect(
-      getAlertsForNotification('timestamp', DEFAULT_FLAPPING_SETTINGS, 0, trackedEvents, newEvents)
+      getAlertsForNotification(
+        DEFAULT_FLAPPING_SETTINGS,
+        0,
+        trackedEvents,
+        newEvents,
+        newEventParams
+      )
     ).toMatchInlineSnapshot(`
       Array [
         Object {
@@ -178,8 +196,9 @@ describe('getAlertsForNotification', () => {
 
   test('should reset activeCount for all recovered alerts', () => {
     const trackedEvents = cloneDeep([alert1, alert2]);
-    expect(getAlertsForNotification('timestamp', DEFAULT_FLAPPING_SETTINGS, 0, trackedEvents, []))
-      .toMatchInlineSnapshot(`
+    expect(
+      getAlertsForNotification(DEFAULT_FLAPPING_SETTINGS, 0, trackedEvents, [], newEventParams)
+    ).toMatchInlineSnapshot(`
       Array [
         Object {
           "activeCount": 0,
@@ -204,30 +223,31 @@ describe('getAlertsForNotification', () => {
     const trackedEvents = cloneDeep([alert4]);
     const newEvents = cloneDeep([alert5]);
     expect(
-      getAlertsForNotification('timestamp', DEFAULT_FLAPPING_SETTINGS, 5, trackedEvents, newEvents)
+      getAlertsForNotification(
+        DEFAULT_FLAPPING_SETTINGS,
+        5,
+        trackedEvents,
+        newEvents,
+        newEventParams
+      )
     ).toMatchInlineSnapshot(`Array []`);
   });
 
   test('should update active alert to look like a new alert if the activeCount is equal to the rule alertDelay', () => {
     const trackedEvents = cloneDeep([alert5]);
     expect(
-      getAlertsForNotification(
-        'timestamp',
-        DEFAULT_FLAPPING_SETTINGS,
-        2,
-        trackedEvents,
-        [],
-        ['maintenance-window-id']
-      )
+      getAlertsForNotification(DEFAULT_FLAPPING_SETTINGS, 2, trackedEvents, [], newEventParams)
     ).toMatchInlineSnapshot(`
       Array [
         Object {
           "activeCount": 2,
           "event": Object {
             "event.action": "open",
+            "kibana.alert.duration.us": 0,
             "kibana.alert.maintenance_window_ids": Array [
               "maintenance-window-id",
             ],
+            "kibana.alert.start": "timestamp",
             "kibana.alert.status": "active",
             "kibana.alert.time_range": Object {
               "gte": "timestamp",

diff --git a/x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.ts b/x-pack/plugins/rule_registry/server/utils/get_alerts_for_notification.ts
@@ -11,29 +11,42 @@ import {
   ALERT_STATUS,
   ALERT_STATUS_ACTIVE,
   ALERT_STATUS_RECOVERED,
+  ALERT_START,
+  ALERT_DURATION,
   EVENT_ACTION,
   ALERT_TIME_RANGE,
   ALERT_MAINTENANCE_WINDOW_IDS,
 } from '@kbn/rule-data-utils';
 
 export function getAlertsForNotification(
-  timestamp: string,
   flappingSettings: RulesSettingsFlappingProperties,
   alertDelay: number,
   trackedEventsToIndex: any[],
   newEventsToIndex: any[],
-  maintenanceWindowIds?: string[]
+  newEventParams: {
+    // values used to create a new event
+    maintenanceWindowIds?: string[];
+    timestamp: string;
+  }
 ) {
   const events: any[] = [];
   for (const trackedEvent of [...newEventsToIndex, ...trackedEventsToIndex]) {
     if (trackedEvent.event[ALERT_STATUS] === ALERT_STATUS_ACTIVE) {
       const count = trackedEvent.activeCount || 0;
       trackedEvent.activeCount = count + 1;
       trackedEvent.pendingRecoveredCount = 0;
+      // do not index the event if the number of consecutive
+      // active alerts is less than the rule alertDelay threshold
       if (trackedEvent.activeCount < alertDelay) {
+        // remove from array of events to index
         continue;
       } else {
+        const { timestamp, maintenanceWindowIds } = newEventParams;
+        // if the active count is equal to the alertDelay it is considered a new event
         if (trackedEvent.activeCount === alertDelay) {
+          // update the event to look like a new event
+          trackedEvent.event[ALERT_DURATION] = 0;
+          trackedEvent.event[ALERT_START] = timestamp;
           trackedEvent.event[ALERT_TIME_RANGE] = { gte: timestamp };
           trackedEvent.event[EVENT_ACTION] = 'open';
           if (maintenanceWindowIds?.length) {