Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] only meter endpoints that are billable #186580

Merged

Conversation

joeypoon
Copy link
Member

@joeypoon joeypoon commented Jun 20, 2024

Summary

Updates the endpoint metering task to only grab heartbeats if billable: true or if billable doesn't exist (for backwards compatibility).

Checklist

For maintainers

@joeypoon joeypoon added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution ci:project-deploy-security Create a Security Serverless Project v8.15.0 labels Jun 20, 2024
@kibanamachine
Copy link
Contributor

Flaky Test Runner Stats

🟠 Some tests failed. - kibana-flaky-test-suite-runner#6363

[❌] [Serverless] Security Solution Defend Workflows - Cypress: 0/25 tests passed.

see run history

@joeypoon joeypoon force-pushed the feature/endpoint-metering-billable-only branch from 65a2220 to d0bb15d Compare June 21, 2024 22:17
@kibanamachine
Copy link
Contributor

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#6370

[✅] [Serverless] Security Solution Defend Workflows - Cypress: 25/25 tests passed.

see run history

@joeypoon joeypoon marked this pull request as ready for review June 22, 2024 01:05
@joeypoon joeypoon requested a review from a team as a code owner June 22, 2024 01:05
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

@joeypoon joeypoon force-pushed the feature/endpoint-metering-billable-only branch from d0bb15d to 16bc156 Compare June 22, 2024 01:06
Copy link
Contributor

@gergoabraham gergoabraham left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks great!

one question: I see you updated the data loader to generate billable, not billable and even invalid docs - but do we have tests in place for this change?

Copy link
Contributor

@tomsonpl tomsonpl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm 👍

@joeypoon
Copy link
Member Author

joeypoon commented Jun 25, 2024

one question: I see you updated the data loader to generate billable, not billable and even invalid docs - but do we have tests in place for this change?

Yeah, it's used here:

No changes were needed to the test itself but this update to the indexing cypress task does get covered by that test.

There was also a previous PR that dealt with adding the flag to the policy and adding associated tests.

@kibana-ci
Copy link
Collaborator

kibana-ci commented Jun 25, 2024

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

Copy link
Contributor

@gergoabraham gergoabraham left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one question: I see you updated the data loader to generate billable, not billable and even invalid docs - but do we have tests in place for this change?

Yeah, it's used here:

No changes were needed to the test itself but this update to the indexing cypress task does get covered by that test.

There was also a previous PR that dealt with adding the flag to the policy and adding associated tests in metering.cy.ts

thanks for the details! i still don't understand how there's no need to update the tests in metering.cy.ts:

  • indexEndpointHeartbeats() indexes HEARTBEAT_COUNT = 2001 number of valid and one invalid documents
  • then after collecting all chunks in the recourse() function, the test expects the number of chunks to equal const expectedChunks = Math.ceil(HEARTBEAT_COUNT / METERING_SERVICE_BATCH_SIZE); chunks <- here i'd expect it should be only half of this, as billable: false | undefined docs shouldn't be reported due to the current changes

or do I miss something?

(also i added another comment, sorry about that, it didn't occur to me on first review)

});

const operations = docs.flatMap((doc) => [
// billable: false are not billed
const invalidDocs: EndpointHeartbeat[] = [
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is now an additional doc to the number of count documents. i'd suggest to include it in count, or add a new option like countOfInvalidDocuments next to count

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't add to count since it is filtered out by the query. We want the count to not include it so we validate that invalid docs aren't incorrectly added to the count. The actual number of invalid docs does not matter here.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i understand it doesn't matter, it's just violating the contract proposed by the function indexEndpointHeartbeat(count), it looks like an unwanted side effect of the loader

@joeypoon
Copy link
Member Author

chunks <- here i'd expect it should be only half of this, as billable: false | undefined docs shouldn't be reported due to the current changes

If billable doesn't exist then it is billed. So both billable: true and billable not exist are billed records. This is because this depends on a mapping change from endpoint package and we cannot guarantee endpoint package being up-to-date. This maintains backwards compatibility.

@gergoabraham
Copy link
Contributor

gergoabraham commented Jun 26, 2024

If billable doesn't exist then it is billed. So both billable: true and billable not exist are billed records. This is because this depends on a mapping change from endpoint package and we cannot guarantee endpoint package being up-to-date. This maintains backwards compatibility.

thanks for the clarification. however, we're still missing the case when billable: false in the tests then. i'd suggest to have a test case for that, too: the changes in the loader does not cover fully the changes in the logic - it's actually covered with the invalid doc, which has billable: false 👍

Copy link
Contributor

@gergoabraham gergoabraham left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

code looks good! 🚀 i'd still suggest to add automated tests to cover the changes - it's actually covered 👍

@joeypoon joeypoon merged commit bd401f6 into elastic:main Jun 26, 2024
39 checks passed
@joeypoon joeypoon deleted the feature/endpoint-metering-billable-only branch June 26, 2024 15:30
@kibanamachine kibanamachine added the backport:skip This commit does not require backporting label Jun 26, 2024
joeypoon added a commit that referenced this pull request Jul 2, 2024
…licit (#187071)

## Summary

Adds a new `unbilledCount` param to the `indexEndpointHeartbeats`
cypress heartbeart indexing task to make the indexed `billable: false`
docs functionality more explicit rather than a side effect as [suggested
in the last
PR](#186580 (comment)).


### Checklist

- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed


### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:skip This commit does not require backporting ci:project-deploy-security Create a Security Serverless Project release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.15.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants