[DOCS] Add/update docs for users upgrading to V3 ML modules #2080
Conversation
joepeeples
added
Team: Docs
Team: Detections/Response
joepeeples
requested review from
benironside,
jmikell821,
nastasha-solomon,
randomuserid and
spong
nastasha-solomon
left a comment
nastasha-solomon
left a comment
There was a problem hiding this comment.
Left some minor suggestions. LGTM otherwise!
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
benironside
left a comment
benironside
left a comment
There was a problem hiding this comment.
Looks good, left a suggestion and a question.
spong
left a comment
spong
left a comment
There was a problem hiding this comment.
Two small nits, but other than that these docs look great @joepeeples! They read really well, cover all the use cases, and make it easy to know what actionable steps the user needs to perform to ensure continued functionality. Thank you for working with @randomuserid and I to get these just right -- appreciate it! 🙂 LGTM!
Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
nastasha-solomon
left a comment
nastasha-solomon
left a comment
There was a problem hiding this comment.
Left some edits for your consideration. LGTM overall though and congrats on working through everything!
|
The smoothest workflow would be this;
In a case where mixed version fleets are running, such as a mix of 8.x and 7.x agents, the new and old (v1 / v2) jobs can be run in parallel - but this will tend to result in some duplicate alerts unless the jobs were modified. A version number filter could be added to the datafeed queries to ensure v3 jobs ingest events from 8.3 / 8.2 agents while v1 / v2 jobs ingest events from older agents. |
benironside
left a comment
benironside
left a comment
There was a problem hiding this comment.
LGTM, I like the updates. Nice work
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com>
Thanks, this is a helpful break-down, @randomuserid. I opened #2159 to document this upgrade path in the Post-upgrade steps section of the docs. That way we can get this PR's changes into the docs for the release, and start directing users to it from the docs links in the UI callout/modal. I'll follow up on the additional upgrade docs soon. |
* Update rules-ui-monitor.asciidoc * Small fixes * Apply suggestions from Nastasha's review Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Revised draft * Minor edit * Apply suggestions from Garrett's review Co-authored-by: Garrett Spong <spong@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: Garrett Spong <spong@users.noreply.github.com> (cherry picked from commit b6de7bd)
…2164) * Update rules-ui-monitor.asciidoc * Small fixes * Apply suggestions from Nastasha's review Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> * Revised draft * Minor edit * Apply suggestions from Garrett's review Co-authored-by: Garrett Spong <spong@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com> Co-authored-by: Garrett Spong <spong@users.noreply.github.com> (cherry picked from commit b6de7bd) Co-authored-by: Joe Peeples <joe.peeples@elastic.co>
Resolves #1748.
Preview: Monitor and troubleshoot rule executions | Troubleshoot missing alerts for machine learning jobs