Add KQL filtering in APM rules #163307

benakansara · 2023-08-07T14:32:41Z

Resolves https://github.com/elastic/apm-dev/issues/929

Adds KQL filtering to the following APM rules:

Latency threshold rule
Failed transaction rate rule
Error count threshold rule

KQL Filter ON

KQL Filter OFF

apmmachine · 2023-08-07T14:32:57Z

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

/oblt-deploy : Deploy a Kibana instance using the Observability test environments.
/oblt-deploy-serverless : Deploy a serverless Kibana instance using the Observability test environments.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

elasticmachine · 2023-08-08T16:44:59Z

Pinging @elastic/actionable-observability (Team: Actionable Observability)

elasticmachine · 2023-08-09T08:04:27Z

Pinging @elastic/apm-ui (Team:APM)

sorenlouv

Looks good. Only big caveat is the custom kql ui component. I was hoping this already existed. We already have unified search and have kql search for service groups (I cannot remember how that is implemented).

x-pack/plugins/apm/common/rules/schema.ts

...plugins/apm/public/components/alerting/ui_components/apm_rule_kql_filter/rule_kql_filter.tsx

x-pack/plugins/apm/server/routes/alerts/route.ts

x-pack/plugins/apm/server/routes/alerts/rule_types/error_count/get_error_count_chart_preview.ts

...plugins/apm/public/components/alerting/rule_types/transaction_error_rate_rule_type/index.tsx

...gins/apm/public/components/alerting/ui_components/apm_rule_kql_filter/autocomplete_field.tsx

x-pack/plugins/apm/public/components/alerting/ui_components/apm_rule_kql_filter/kuery_bar.tsx

...ck/plugins/apm/server/routes/alerts/rule_types/error_count/register_error_count_rule_type.ts

x-pack/plugins/apm/server/routes/alerts/rule_types/utils/get_parsed_filtered_query.ts

benakansara · 2023-08-11T09:32:09Z

Looks good. Only big caveat is the custom kql ui component. I was hoping this already existed. We already have unified search and have kql search for service groups (I cannot remember how that is implemented).

Refactored the code to reuse KQL filter related components from observability plugin. I looked into Unified Search component, but it has some additional functionalities like adding params to URL, calendar, refresh, etc. that we don't need for adding filter query in rule.

x-pack/test/apm_api_integration/tests/alerts/preview_chart_error_count.spec.ts

sorenlouv · 2023-08-11T19:58:50Z

Thanks Bena!

maryam-saeidi · 2023-08-14T09:52:45Z

x-pack/plugins/observability/public/components/rule_kql_filter/kuery_bar.tsx

@@ -91,7 +83,7 @@ export function MetricsExplorerKueryBar({
          loadSuggestions={curryLoadSuggestions(loadSuggestions)}
          onChange={handleChange}
          onSubmit={onSubmit}
-          placeholder={placeholder || defaultPlaceholder}
+          placeholder={placeholder}


Would you please make the placeholder mandatory in the props (on line 30 of this file)?

The placeholder can be empty sometimes, like in (even though it is set as ' ') -

kibana/x-pack/plugins/infra/public/alerting/metric_threshold/components/custom_equation/metric_row_with_count.tsx

Line 96 in 933f2a5

placeholder={' '}

Why do we want to make it mandatory?

Hmm, I thought we had a default there to ensure we always have a placeholder, if there are valid cases that we don't want a placeholder, then having it optional is fine.

The default placeholder was there with defaultPlaceholder which contained text Search for infrastructure data… (e.g. host.name:host-1). Since we need different placeholder text in Threshold and APM rules, I moved it to respective rule files, so there is no default place holder now.

maryam-saeidi

AO changes LGTM!

I have a question overall about whether adding the KQL filter can cause confusion or not and what the expectation is for it.
For example, in the following case, I was able to add a filter for another service when adding the rule in the current service:

I think it will make the rule complicated, @benakansara is there any idea about how to avoid such cases?

maryam-saeidi · 2023-08-14T10:13:28Z

x-pack/plugins/apm/public/components/alerting/rule_types/error_count_rule_type/index.tsx

  return (
    <ApmRuleParamsContainer
      minimumWindowSize={{ value: 5, unit: TIME_UNITS.MINUTE }}
      defaultParams={params}
      fields={fields}
      groupAlertsBy={groupAlertsBy}
+      kqlFilter={kqlFilter}


nit: Can we make the space before Use KQL filter a bit less? (Maybe before and after of this component can have the same spacing?)

maryam-saeidi · 2023-08-14T10:33:17Z

x-pack/plugins/apm/common/rules/schema.ts

@@ -17,6 +17,8 @@ export const errorCountParamsSchema = schema.object({
  environment: schema.string(),
  groupBy: schema.maybe(schema.arrayOf(schema.string())),
  errorGroupingKey: schema.maybe(schema.string()),
+  useKqlFilter: schema.maybe(schema.boolean()),
+  kqlFilter: schema.maybe(schema.string()),


@benakansara For the threshold rule, we use filterQuery as the field name, and here we have it as kqlFilter. Shall we use the same name for both rules? (Not sure which one to choose though 🤔 )

benakansara · 2023-08-14T12:55:43Z

AO changes LGTM!

I have a question overall about whether adding the KQL filter can cause confusion or not and what the expectation is for it. For example, in the following case, I was able to add a filter for another service when adding the rule in the current service:

I think it will make the rule complicated, @benakansara is there any idea about how to avoid such cases?

@maryam-saeidi That's a good point. I think it is upto the user to add right filters. We have similar behaviour when creating a rule from "Hosts" view. Even though user has selected a host, and started creating a rule, they can add different hosts in filter. The difference is that the rule name is not auto-generated in this case.

@sqren What are your thoughts around this?

maryam-saeidi · 2023-08-14T13:24:13Z

The difference is that the rule name is not auto-generated in this case.

Exactly, that's the difference that I see here. (Also the tags)

Maybe I am missing something but I didn't see the filtering for the host when I created a rule from a host page, do they add something host specific to the rule when it is created within a host page?

shahzad31 · 2023-08-14T14:21:50Z

Please close this and open a new PR if possible, this will keep pinging all the people, changing to draft doens't unsubs all the teams pinged

benakansara · 2023-08-14T14:24:29Z

Please close this and open a new PR if possible, this will keep pinging all the people, changing to draft doens't unsubs all the teams pinged

@shahzad31 Sorry about that, something went wrong while merging to main. I have removed all the other teams from reviewers list, does it still ping them?

kibana-ci · 2023-08-14T14:26:01Z

💔 Build Failed

Failed CI Steps

Metrics [docs]

‼️ ERROR: metrics for e01c3e3 were not reported

History

💔 Build #150078 failed 2125087
💛 Build #149550 was flaky ea623ce
💔 Build #149345 failed 3452949
💛 Build #148623 was flaky 933d97f

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @benakansara

benakansara · 2023-08-14T14:43:30Z

@maryam-saeidi @sqren Opening a new PR as this one pinged many teams after merging to main. Removing teams from reviewers list doesn't unsubscribe them from notifications.
cc @shahzad31

Resolves elastic/apm-dev#929 Adds KQL filtering to the following APM rules: - Latency threshold rule - Failed transaction rate rule - Error count threshold rule ### KQL Filter ON <img width="598" alt="Screenshot 2023-07-31 at 16 45 13" src="https://github.com/elastic/kibana/assets/69037875/277ac4c1-a542-4efe-bd0c-c2bccfac1a6c"> ### KQL Filter OFF <img width="602" alt="Screenshot 2023-07-31 at 16 47 23" src="https://github.com/elastic/kibana/assets/69037875/f790ed56-d83d-4732-aa3e-4d7778926fbb"> ### Note Opening a new PR as #163307 pinged many teams after merging to main. Removing teams from reviewers list doesn't unsubscribe them from notifications.

Resolves elastic/apm-dev#929 Adds KQL filtering to the following APM rules: - Latency threshold rule - Failed transaction rate rule - Error count threshold rule ### KQL Filter ON <img width="598" alt="Screenshot 2023-07-31 at 16 45 13" src="https://github.com/elastic/kibana/assets/69037875/277ac4c1-a542-4efe-bd0c-c2bccfac1a6c"> ### KQL Filter OFF <img width="602" alt="Screenshot 2023-07-31 at 16 47 23" src="https://github.com/elastic/kibana/assets/69037875/f790ed56-d83d-4732-aa3e-4d7778926fbb"> ### Note Opening a new PR as elastic#163307 pinged many teams after merging to main. Removing teams from reviewers list doesn't unsubscribe them from notifications.

Resolves elastic/apm-dev#929 Adds KQL filtering to the following APM rules: - Latency threshold rule - Failed transaction rate rule - Error count threshold rule ### KQL Filter ON <img width="598" alt="Screenshot 2023-07-31 at 16 45 13" src="https://github.com/elastic/kibana/assets/69037875/277ac4c1-a542-4efe-bd0c-c2bccfac1a6c"> ### KQL Filter OFF <img width="602" alt="Screenshot 2023-07-31 at 16 47 23" src="https://github.com/elastic/kibana/assets/69037875/f790ed56-d83d-4732-aa3e-4d7778926fbb"> ### Note Opening a new PR as #163307 pinged many teams after merging to main. Removing teams from reviewers list doesn't unsubscribe them from notifications.

benakansara self-assigned this Aug 7, 2023

benakansara added release_note:feature Makes this part of the condensed release notes Team: Actionable Observability - DEPRECATED For Observability Alerting and SLOs use "Team:obs-ux-management", for AIops "Team:obs-knowledge" v8.10.0 labels Aug 7, 2023

benakansara marked this pull request as ready for review August 8, 2023 16:44

benakansara requested a review from a team as a code owner August 8, 2023 16:44

botelastic bot added the Team:APM All issues that need APM UI Team support label Aug 9, 2023

sorenlouv reviewed Aug 10, 2023

View reviewed changes

benakansara requested a review from a team as a code owner August 11, 2023 08:51

benakansara requested a review from sorenlouv August 11, 2023 09:32

sorenlouv reviewed Aug 11, 2023

View reviewed changes

x-pack/test/apm_api_integration/tests/alerts/preview_chart_error_count.spec.ts Outdated Show resolved Hide resolved

sorenlouv approved these changes Aug 11, 2023

View reviewed changes

benakansara mentioned this pull request Aug 14, 2023

Use Unified Search bar for the KQL filter in APM rules #163781

Closed

maryam-saeidi reviewed Aug 14, 2023

View reviewed changes

maryam-saeidi requested changes Aug 14, 2023

View reviewed changes

maryam-saeidi reviewed Aug 14, 2023

View reviewed changes

benakansara requested review from a team as code owners August 14, 2023 13:29

benakansara added 16 commits August 14, 2023 16:01

added tests

fd2b1c9

fix test

877902e

fix test

20afbce

fix test

85b315a

fix tests

ab776d6

fix tests

2444acc

remove commented code

6c0bf67

renaming

5d98cac

remove useKqlFilter from server

50ec1a9

renaming

ec167cd

pr feedback

c69e95c

refactoring to reuse KQL filter from observability

8ee04ce

refactoring to reuse getParsedFilterQuery from observability

d19160f

update data-test-subject

b3ef493

fix tests

c70dcc4

use getErrorGroupingKey

87760ca

benakansara force-pushed the feat/add-kql-filtering-in-apm-rules branch 2 times, most recently from 4bd8292 to 87760ca Compare August 14, 2023 14:13

benakansara and others added 2 commits August 14, 2023 16:15

Merge branch 'main' into feat/add-kql-filtering-in-apm-rules

d6706d2

pr feedback

e01c3e3

benakansara mentioned this pull request Aug 14, 2023

Add KQL filtering in APM rules #163825

Merged

benakansara closed this Aug 14, 2023

benakansara deleted the feat/add-kql-filtering-in-apm-rules branch October 23, 2023 07:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add KQL filtering in APM rules #163307

Add KQL filtering in APM rules #163307

benakansara commented Aug 7, 2023 •

edited

apmmachine commented Aug 7, 2023

elasticmachine commented Aug 8, 2023

elasticmachine commented Aug 9, 2023

sorenlouv left a comment

benakansara commented Aug 11, 2023

sorenlouv commented Aug 11, 2023

maryam-saeidi Aug 14, 2023

benakansara Aug 14, 2023

maryam-saeidi Aug 14, 2023

benakansara Aug 14, 2023

maryam-saeidi left a comment •

edited

maryam-saeidi Aug 14, 2023 •

edited

maryam-saeidi Aug 14, 2023 •

edited

benakansara commented Aug 14, 2023

maryam-saeidi commented Aug 14, 2023 •

edited

shahzad31 commented Aug 14, 2023

benakansara commented Aug 14, 2023

kibana-ci commented Aug 14, 2023 •

edited

benakansara commented Aug 14, 2023

Add KQL filtering in APM rules #163307

Add KQL filtering in APM rules #163307

Conversation

benakansara commented Aug 7, 2023 • edited

KQL Filter ON

KQL Filter OFF

apmmachine commented Aug 7, 2023

🤖 GitHub comments

elasticmachine commented Aug 8, 2023

elasticmachine commented Aug 9, 2023

sorenlouv left a comment

Choose a reason for hiding this comment

benakansara commented Aug 11, 2023

sorenlouv commented Aug 11, 2023

maryam-saeidi Aug 14, 2023

Choose a reason for hiding this comment

benakansara Aug 14, 2023

Choose a reason for hiding this comment

maryam-saeidi Aug 14, 2023

Choose a reason for hiding this comment

benakansara Aug 14, 2023

Choose a reason for hiding this comment

maryam-saeidi left a comment • edited

Choose a reason for hiding this comment

maryam-saeidi Aug 14, 2023 • edited

Choose a reason for hiding this comment

maryam-saeidi Aug 14, 2023 • edited

Choose a reason for hiding this comment

benakansara commented Aug 14, 2023

maryam-saeidi commented Aug 14, 2023 • edited

shahzad31 commented Aug 14, 2023

benakansara commented Aug 14, 2023

kibana-ci commented Aug 14, 2023 • edited

💔 Build Failed

Failed CI Steps

Metrics [docs]

History

benakansara commented Aug 14, 2023

benakansara commented Aug 7, 2023 •

edited

maryam-saeidi left a comment •

edited

maryam-saeidi Aug 14, 2023 •

edited

maryam-saeidi Aug 14, 2023 •

edited

maryam-saeidi commented Aug 14, 2023 •

edited

kibana-ci commented Aug 14, 2023 •

edited