Enable failure store in discover

[flash1293]

This is a POC that enables the failure store in discover.

Walkthrough (with sound):

Screen.Recording.2024-05-17.at.16.57.48.mov

To reproduce:

PUT _ingest/pipeline/counter-app
{
  "description": "Processes 100% authentic, completely real, production-grade counter data",
  "processors": [
    {
      "set": {
        "tag": "apply timestamp", 
        "field": "@timestamp",
        "override": false,
        "copy_from": "_ingest.timestamp"
      }
    },
    {
      "script": {
        "tag": "decode counter",
        "source": """
          String count = ctx['count'];
          if ('one'.equals(count)) {
            ctx['count'] = 1;
          } else if ('two'.equals(count)) {
            ctx['count'] = 2;
          } else if ('three'.equals(count)) {
            ctx['count'] = 3;
          } else if ('four'.equals(count)) {
            ctx['count'] = 4;
          } else if ('five'.equals(count)) {
            ctx['count'] = 5;
          } else {
            throw new Exception("That's not a number!");
          }
        """
      }
    }
  ]
}

PUT _index_template/counter-app
{
  "index_patterns": ["*-counter.app-*"],
  "priority": 105, 
  "data_stream": {
    "failure_store": true
  },
  "template": {
    "settings": {
      "index.default_pipeline": "counter-app"
    }, 
    "mappings": {
      "properties": {
        "count": {
          "type": "long"
        },
        "@timestamp": {
          "type": "date"
        }
      }
    }
  }
}

POST demo-counter.app-prod/_doc
{
  "count": "one"
}

POST demo-counter.app-prod/_doc
{
  "count": "two hundred"
}

When creating a data view, there is a new advanced setting (default is exclude, setting it to only will only return the error documents).

[apmmachine]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)