feat(slo): Add timestampField additional settings (#153395)

packages/kbn-slo-schema/src/schema/indicators.ts

@@ -50,12 +50,17 @@ const apmTransactionErrorRateIndicatorSchema = t.type({
 const kqlCustomIndicatorTypeSchema = t.literal('sli.kql.custom');
 const kqlCustomIndicatorSchema = t.type({
   type: kqlCustomIndicatorTypeSchema,
-  params: t.type({
-    index: t.string,
-    filter: t.string,
-    good: t.string,
-    total: t.string,
-  }),
+  params: t.intersection([
+    t.type({
+      index: t.string,
+      filter: t.string,
+      good: t.string,
+      total: t.string,
+    }),
+    t.partial({
+      timestampField: t.string,
+    }),
+  ]),
 });
 
 const indicatorDataSchema = t.type({

packages/kbn-slo-schema/src/schema/slo.ts

@@ -26,7 +26,6 @@ const objectiveSchema = t.intersection([
 ]);
 
 const settingsSchema = t.type({
-  timestampField: t.string,
   syncDelay: durationType,
   frequency: durationType,
 });

src/core/server/integration_tests/saved_objects/migrations/group2/check_registered_types.test.ts

@@ -134,7 +134,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "siem-ui-timeline": "e9d6b3a9fd7af6dc502293c21cbdb309409f3996",
         "siem-ui-timeline-note": "13c9d4c142f96624a93a623c6d7cba7e1ae9b5a6",
         "siem-ui-timeline-pinned-event": "96a43d59b9e2fc11f12255a0cb47ef0a3d83af4c",
-        "slo": "06733daaa5fbe331fdf3b515171978aff483ccf2",
+        "slo": "af2a119f3bceee5f12dc02d7eb4f54040bae4557",
         "space": "7fc578a1f9f7708cb07479f03953d664ad9f1dae",
         "spaces-usage-stats": "084bd0f080f94fb5735d7f3cf12f13ec92f36bad",
         "synthetics-monitor": "96cc312bfa597022f83dfb3b5d1501e27a73e8d5",

x-pack/plugins/observability/dev_docs/slo.md

@@ -12,7 +12,7 @@ We currently support the following SLI:
 
 For the APM SLIs, customer can provide the service, environment, transaction name and type to configure them. For the **APM Latency** SLI, a threshold in milliseconds needs to be provided to discriminate the good and bad responses (events). For the **APM Availability** SLI, a list of good status codes needs to be provided to discriminate the good and bad responses (events). The API supports an optional kql filter to further filter the apm data.
 
-The **custom KQL** SLI requires an index pattern, an optional filter query, a numerator query, and denominator query.
+The **custom KQL** SLI requires an index pattern, an optional filter query, a numerator query, and denominator query. A custom 'timestampField' can be provided to override the default @timestamp field.
 
 ## SLO configuration
 
@@ -43,7 +43,6 @@ If a **timeslices** budgeting method is used, we also need to define the **times
 
 The default settings should be sufficient for most users, but if needed, the following properties can be overwritten:
 
-- **timestampField**: The date time field to use from the source index
 - **syncDelay**: The ingest delay in the source data
 - **frequency**: How often do we query the source data
 
@@ -299,7 +298,8 @@ curl --request POST \
 			"index": "high-cardinality-data-fake_logs*",
 			"good": "latency < 300",
 			"total": "",
-			"filter": "labels.groupId: group-0"
+			"filter": "labels.groupId: group-0",
+			"timestampField": "custom_timestamp"
 		}
 	},
 	"timeWindow": {

x-pack/plugins/observability/docs/openapi/slo/bundled.yaml

@@ -379,6 +379,11 @@ components:
               description: the KQL query used to define all events.
               type: string
               example: ''
+            timestampField:
+              description: |
+                The timestamp field used in the source indice. If not specified, @timestamp will be used.
+              type: string
+              example: timestamp
         type:
           description: The type of indicator.
           type: string
@@ -554,11 +559,6 @@ components:
       description: Defines properties for settings.
       type: object
       properties:
-        timestampField:
-          description: |
-            The timestamp field used in the source indice. Particularly useful for custom kql indicator type, when the index does not use the default '@timestamp' field
-          type: string
-          example: timestamp
         syncDelay:
           description: The synch delay to apply to the transform. Default 1m
           type: string

x-pack/plugins/observability/docs/openapi/slo/components/schemas/indicator_properties_custom_kql.yaml

@@ -28,6 +28,11 @@ properties:
         description: the KQL query used to define all events.
         type: string
         example: ''
+      timestampField:
+        description: >
+          The timestamp field used in the source indice. If not specified, @timestamp will be used.
+        type: string
+        example: timestamp
   type:
     description: The type of indicator.
     type: string

x-pack/plugins/observability/docs/openapi/slo/components/schemas/settings.yaml

@@ -2,12 +2,6 @@ title: Settings definition
 description: Defines properties for settings.
 type: object
 properties:
-  timestampField:
-    description: >
-      The timestamp field used in the source indice. Particularly useful for custom kql indicator type, when the index
-      does not use the default '@timestamp' field
-    type: string
-    example: timestamp
   syncDelay:
     description: The synch delay to apply to the transform. Default 1m
     type: string

x-pack/plugins/observability/public/data/slo/slo.ts

@@ -38,6 +38,7 @@ const baseSlo: Omit<SLOWithSummaryResponse, 'id'> = {
       filter: 'baz: foo and bar > 2',
       good: 'http_status: 2xx',
       total: 'a query',
+      timestampField: 'custom_timestamp',
     },
   },
   timeWindow: {
@@ -48,7 +49,6 @@ const baseSlo: Omit<SLOWithSummaryResponse, 'id'> = {
   budgetingMethod: 'occurrences',
   revision: 1,
   settings: {
-    timestampField: '@timestamp',
     syncDelay: '1m',
     frequency: '1m',
   },

x-pack/plugins/observability/public/pages/slo_edit/components/custom_kql/custom_kql_indicator_type_form.tsx

@@ -5,17 +5,30 @@
  * 2.0.
  */
 
-import React from 'react';
-import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui';
+import React, { useState } from 'react';
+import {
+  EuiFieldText,
+  EuiFlexGroup,
+  EuiFlexItem,
+  EuiFormLabel,
+  EuiIcon,
+  EuiLink,
+} from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
-import { useFormContext } from 'react-hook-form';
+import { Controller, useFormContext } from 'react-hook-form';
 import { CreateSLOInput } from '@kbn/slo-schema';
 
 import { IndexSelection } from './index_selection';
 import { QueryBuilder } from '../common/query_builder';
 
 export function CustomKqlIndicatorTypeForm() {
   const { control, watch } = useFormContext<CreateSLOInput>();
+  const [isAdditionalSettingsOpen, setAdditionalSettingsOpen] = useState<boolean>(false);
+
+  const handleAdditionalSettingsClick = () => {
+    setAdditionalSettingsOpen(!isAdditionalSettingsOpen);
+  };
+
   return (
     <EuiFlexGroup direction="column" gutterSize="l">
       <EuiFlexItem>
@@ -75,6 +88,48 @@ export function CustomKqlIndicatorTypeForm() {
           )}
         />
       </EuiFlexItem>
+
+      <EuiFlexGroup direction="column" gutterSize="l">
+        <EuiFlexItem>
+          <EuiLink
+            data-test-subj="customKqlIndicatorFormAdditionalSettingsToggle"
+            onClick={handleAdditionalSettingsClick}
+          >
+            <EuiIcon type={isAdditionalSettingsOpen ? 'arrowDown' : 'arrowRight'} />{' '}
+            {i18n.translate('xpack.observability.slo.sloEdit.sliType.additionalSettings.label', {
+              defaultMessage: 'Additional settings',
+            })}
+          </EuiLink>
+        </EuiFlexItem>
+
+        {isAdditionalSettingsOpen && (
+          <EuiFlexItem>
+            <EuiFormLabel>
+              {i18n.translate(
+                'xpack.observability.slo.sloEdit.additionalSettings.timestampField.label',
+                { defaultMessage: 'Timestamp field' }
+              )}
+            </EuiFormLabel>
+
+            <Controller
+              name="indicator.params.timestampField"
+              shouldUnregister
+              control={control}
+              render={({ field: { ref, ...field } }) => (
+                <EuiFieldText
+                  {...field}
+                  disabled={!watch('indicator.params.index')}
+                  data-test-subj="sloFormAdditionalSettingsTimestampField"
+                  placeholder={i18n.translate(
+                    'xpack.observability.slo.sloEdit.additionalSettings.timestampField.placeholder',
+                    { defaultMessage: 'Timestamp field used in the index, default to @timestamp' }
+                  )}
+                />
+              )}
+            />
+          </EuiFlexItem>
+        )}
+      </EuiFlexGroup>
     </EuiFlexGroup>
   );
 }