Skip to content

Comments

[Observability] [Alert] Add context.grouping action variable in SLO Burn rate and ES Query rules#213550

Merged
benakansara merged 32 commits intoelastic:mainfrom
benakansara:feat/add-context-grouping-action-variable
May 2, 2025
Merged

[Observability] [Alert] Add context.grouping action variable in SLO Burn rate and ES Query rules#213550
benakansara merged 32 commits intoelastic:mainfrom
benakansara:feat/add-context-grouping-action-variable

Conversation

@benakansara
Copy link
Contributor

@benakansara benakansara commented Mar 7, 2025 •
edited by kibanamachine
Loading

Part of #180709

Adds context.grouping action variable in the following rules:

  • SLO Burn rate rule
  • ES Query rule

Testing

  1. Create each rule with group by fields, and with "active" and "recovered" actions
  • for SLO Burn rate rule, group by fields are derived from the SLO so you need to create SLO with group by fields
  • for ES Query rule, use "Grouped over"
  1. In "active" and "recovered" action message, use context.grouping variable
  2. Ensure that both "active" and "recovered" alert notifications contain correct information
  3. Ensure that the action variables UI in rule form shows context.grouping action variable

Example of action message:

{
  "grouping": "{{context.grouping}}",
  "host.name": "{{context.grouping.host.name}}",
  "container.id": "{{context.grouping.container.id}}"
}

@benakansara benakansara marked this pull request as ready for review March 10, 2025 20:29
@benakansara benakansara requested review from a team as code owners March 10, 2025 20:29
@benakansara benakansara self-assigned this Mar 10, 2025
@benakansara benakansara added backport:skip This PR does not require backporting release_note:feature Makes this part of the condensed release notes Team:actionable-obs Formerly "obs-ux-management", responsible for SLO, o11y alerting, significant events, & synthetics. labels Mar 10, 2025
@elasticmachine
Copy link
Contributor

elasticmachine commented Mar 10, 2025

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

@pmuellr
Copy link
Contributor

pmuellr commented Mar 11, 2025

Just a quick scan so far ...

I think we want this for index threshold as well, can be done in a separate PR, but just wanted to check that all rule types that group should now follow this "standard" way of exposing the grouping info? Context variables and alert docs?

We'll want some FT for both the alert docs and variables. Here's one for EQ / ES|QL alerts: x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group3/builtin_alert_types/es_query/esql_only.ts

Actually not sure we have rule-type specific tests for context variables. We should, may have to poke around ...

@kdelemme kdelemme self-requested a review March 15, 2025 14:17
kdelemme
kdelemme approved these changes Mar 17, 2025
View reviewed changes
Copy link
Contributor

@kdelemme kdelemme left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested locally and works as expected. LGTM!

@benakansara
Copy link
Contributor Author

benakansara commented Mar 20, 2025

@pmuellr

I think we want this for index threshold as well, can be done in a separate PR, but just wanted to check that all rule types that group should now follow this "standard" way of exposing the grouping info?

sure, I agree it makes sense to add this variable in index threshold rule as well. I have created an issue for it and will open a separate PR.

Context variables and alert docs?

This PR covers only context variable part. For alert document, as you might be aware there is an ongoing discussion about how we can store this information, so it will be done separately.

We'll want some FT for both the alert docs and variables. Here's one for EQ / ES|QL alerts: x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group3/builtin_alert_types/es_query/esql_only.ts

I found api integration tests for context variable and alert document for ES Query rule with DSL in x-pack/test/api_integration/deployment_agnostic/apis/observability/alerting/es_query/query_dsl_with_group_by.ts. I have updated tests accordingly for context variable in c4ddaec.

Does ES|QL rule work with group by, and are we storing the group by fields in rule params somehow? In this PR, I have only covered KQL and Query DSL types.

Actually not sure we have rule-type specific tests for context variables. We should, may have to poke around ...

Let me know if you find other context variable specific tests that should be updated.

@pmuellr
Copy link
Contributor

pmuellr commented Mar 20, 2025

Does ES|QL rule work with group by, and are we storing the group by fields in rule params somehow? In this PR, I have only covered KQL and Query DSL types.

There is a PR in review to add grouping right now, and I let @doakalexi know about this one. We only have one level of grouping (right now - didn't think about how this might work for multiple levels 🤔). And we determine it dynamically given we can get good enough info from the ES|QL itself.

@benakansara
Copy link
Contributor Author

benakansara commented Mar 26, 2025

@elasticmachine merge upstream

pmuellr
pmuellr requested changes Mar 26, 2025
View reviewed changes
Copy link
Contributor

@pmuellr pmuellr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some comments, and I want to bang on the getGroupByObject() a bit more. We'll need a test for that, and hopefully we can reduce it to one version instead of two.

@benakansara benakansara requested a review from a team April 10, 2025 11:33
@elasticmachine
Copy link
Contributor

elasticmachine commented Apr 30, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
@kbn/alerting-rule-utils 5 13 +8
triggersActionsUi 529 530 +1
total +9

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
triggersActionsUi 100.3KB 100.4KB +101.0B
Unknown metric groups

API count

id before after diff
@kbn/alerting-rule-utils 5 13 +8
triggersActionsUi 535 536 +1
total +9

History

cc @benakansara

jloleysens
jloleysens approved these changes May 1, 2025
View reviewed changes
Copy link
Contributor

@jloleysens jloleysens left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addition of flatten object test LGTM

This was referenced May 2, 2025
Closed
Closed
@benakansara benakansara linked an issue May 2, 2025 that may be closed by this pull request
[Observability] [Alert Context] Streamline the method of saving group information in alert's context #180709
Closed
4 tasks
This was referenced May 2, 2025
Closed
Closed
pmuellr
pmuellr approved these changes May 2, 2025
View reviewed changes
Copy link
Contributor

@pmuellr pmuellr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ResponseOps changes LGTM. Noted that we should move towards removing the usages of split() on the "comma concatenated strings" where possible, since that would be problematic for embedded strings containing commas.

x-pack/platform/packages/shared/alerting-rule-utils/src/group_by_object_utils.ts
import { unflattenObject } from '@kbn/object-utils';
import { Group } from './types';

export const getGroupByObject = (
Copy link
Contributor

@pmuellr pmuellr May 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The two exported functions still seem to be used by log , metric and custom threshold rule types. These seem to just be used in generating the action variables for mustache, so I don't think this is critical to fix - however, it does feel like we should be avoiding parsing these group strings, if possible. Could be done in a future PR ...

Copy link
Contributor Author

@benakansara benakansara May 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agree! I have created follow-up tickets to remove usages of split():

@benakansara benakansara enabled auto-merge (squash) May 2, 2025 21:03
@benakansara benakansara added backport:version Backport to applied version labels v8.19.0 and removed backport:skip This PR does not require backporting labels May 2, 2025
@benakansara benakansara merged commit 3c1b882 into elastic:main May 2, 2025
14 checks passed
@kibanamachine
Copy link
Contributor

kibanamachine commented May 2, 2025

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/14803519071

@kibanamachine
Copy link
Contributor

kibanamachine commented May 2, 2025

💔 All backports failed

Status Branch Result
❌ 8.19 Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 213550

Questions ?

Please refer to the Backport tool documentation

@kibanamachine kibanamachine mentioned this pull request May 2, 2025
Merged
@benakansara benakansara mentioned this pull request May 5, 2025
Merged
@benakansara
Copy link
Contributor Author

benakansara commented May 5, 2025

💚 All backports created successfully

Status Branch Result
✅ 8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

benakansara added a commit to benakansara/kibana that referenced this pull request May 5, 2025
@benakansara @kibanamachine @elasticmachine
[Observability] [Alert] Add context.grouping action variable in SLO B…
58f55cd 
…urn rate and ES Query rules (elastic#213550)

Part of elastic#180709

Adds `context.grouping` action variable in the following rules:
- SLO Burn rate rule
- ES Query rule
1. Create each rule with group by fields, and with "active" and
"recovered" actions
- for SLO Burn rate rule, group by fields are derived from the SLO so
you need to create SLO with group by fields
- for ES Query rule, use "Grouped over"
2. In "active" and "recovered" action message, use `context.grouping`
variable
3. Ensure that both "active" and "recovered" alert notifications contain
correct information
4. Ensure that the action variables UI in rule form shows
`context.grouping` action variable

Example of action message:

```
{
  "grouping": "{{context.grouping}}",
  "host.name": "{{context.grouping.host.name}}",
  "container.id": "{{context.grouping.container.id}}"
}
```

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 3c1b882)
benakansara added a commit that referenced this pull request May 5, 2025
@benakansara @kibanamachine
[8.19] [Observability] [Alert] Add context.grouping action variable i…
66a1b0f 
…n SLO Burn rate and ES Query rules (#213550) (#220055)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Observability] [Alert] Add context.grouping action variable in SLO
Burn rate and ES Query rules
(#213550)](#213550)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Bena
Kansara","email":"69037875+benakansara@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-05-02T21:16:45Z","message":"[Observability]
[Alert] Add context.grouping action variable in SLO Burn rate and ES
Query rules (#213550)\n\nPart of
https://github.com/elastic/kibana/issues/180709\n\nAdds
`context.grouping` action variable in the following rules:\n- SLO Burn
rate rule\n- ES Query rule\n\n### Testing\n1. Create each rule with
group by fields, and with \"active\" and\n\"recovered\" actions\n- for
SLO Burn rate rule, group by fields are derived from the SLO so\nyou
need to create SLO with group by fields\n- for ES Query rule, use
\"Grouped over\"\n2. In \"active\" and \"recovered\" action message, use
`context.grouping`\nvariable\n3. Ensure that both \"active\" and
\"recovered\" alert notifications contain\ncorrect information\n4.
Ensure that the action variables UI in rule form
shows\n`context.grouping` action variable\n\nExample of action
message:\n\n```\n{\n \"grouping\": \"{{context.grouping}}\",\n
\"host.name\": \"{{context.grouping.host.name}}\",\n \"container.id\":
\"{{context.grouping.container.id}}\"\n}\n```\n\n---------\n\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"3c1b8825f689a74c91d1a1dc762754653767b0cc","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:feature","Team:obs-ux-infra_services","Team:obs-ux-management","backport:version","v9.1.0","v8.19.0"],"title":"[Observability]
[Alert] Add context.grouping action variable in SLO Burn rate and ES
Query
rules","number":213550,"url":"https://github.com/elastic/kibana/pull/213550","mergeCommit":{"message":"[Observability]
[Alert] Add context.grouping action variable in SLO Burn rate and ES
Query rules (#213550)\n\nPart of
https://github.com/elastic/kibana/issues/180709\n\nAdds
`context.grouping` action variable in the following rules:\n- SLO Burn
rate rule\n- ES Query rule\n\n### Testing\n1. Create each rule with
group by fields, and with \"active\" and\n\"recovered\" actions\n- for
SLO Burn rate rule, group by fields are derived from the SLO so\nyou
need to create SLO with group by fields\n- for ES Query rule, use
\"Grouped over\"\n2. In \"active\" and \"recovered\" action message, use
`context.grouping`\nvariable\n3. Ensure that both \"active\" and
\"recovered\" alert notifications contain\ncorrect information\n4.
Ensure that the action variables UI in rule form
shows\n`context.grouping` action variable\n\nExample of action
message:\n\n```\n{\n \"grouping\": \"{{context.grouping}}\",\n
\"host.name\": \"{{context.grouping.host.name}}\",\n \"container.id\":
\"{{context.grouping.container.id}}\"\n}\n```\n\n---------\n\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"3c1b8825f689a74c91d1a1dc762754653767b0cc"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213550","number":213550,"mergeCommit":{"message":"[Observability]
[Alert] Add context.grouping action variable in SLO Burn rate and ES
Query rules (#213550)\n\nPart of
https://github.com/elastic/kibana/issues/180709\n\nAdds
`context.grouping` action variable in the following rules:\n- SLO Burn
rate rule\n- ES Query rule\n\n### Testing\n1. Create each rule with
group by fields, and with \"active\" and\n\"recovered\" actions\n- for
SLO Burn rate rule, group by fields are derived from the SLO so\nyou
need to create SLO with group by fields\n- for ES Query rule, use
\"Grouped over\"\n2. In \"active\" and \"recovered\" action message, use
`context.grouping`\nvariable\n3. Ensure that both \"active\" and
\"recovered\" alert notifications contain\ncorrect information\n4.
Ensure that the action variables UI in rule form
shows\n`context.grouping` action variable\n\nExample of action
message:\n\n```\n{\n \"grouping\": \"{{context.grouping}}\",\n
\"host.name\": \"{{context.grouping.host.name}}\",\n \"container.id\":
\"{{context.grouping.container.id}}\"\n}\n```\n\n---------\n\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"3c1b8825f689a74c91d1a1dc762754653767b0cc"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
@doakalexi doakalexi mentioned this pull request May 6, 2025
Merged
1 task
doakalexi added a commit that referenced this pull request May 7, 2025
@doakalexi
[ResponseOps] Update ES|QL ES query rule for context.grouping action …
d72c62c 
…variable (#220302)

Follow on from this PR that was merged,
#213550
## Summary

This PR updates the ES|QL grouping processing to work with the
`context.grouping` action variable.


### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### To verify
1. Create an ES|QL rule with grouping.
2. In "active" and "recovered" action message, use `context.grouping`
variable
3. Verify that both "active" and "recovered" alert notifications contain
correct information

Example if grouping on `host.name` and `container.id`:

```
{
  "grouping": "{{context.grouping}}",
  "host.name": "{{context.grouping.host.name}}",
  "container.id": "{{context.grouping.container.id}}"
}
```
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request May 7, 2025
@doakalexi
[ResponseOps] Update ES|QL ES query rule for context.grouping action …
ff4febb 
…variable (elastic#220302)

Follow on from this PR that was merged,
elastic#213550
## Summary

This PR updates the ES|QL grouping processing to work with the
`context.grouping` action variable.

### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### To verify
1. Create an ES|QL rule with grouping.
2. In "active" and "recovered" action message, use `context.grouping`
variable
3. Verify that both "active" and "recovered" alert notifications contain
correct information

Example if grouping on `host.name` and `container.id`:

```
{
  "grouping": "{{context.grouping}}",
  "host.name": "{{context.grouping.host.name}}",
  "container.id": "{{context.grouping.container.id}}"
}
```

(cherry picked from commit d72c62c)
kibanamachine added a commit that referenced this pull request May 7, 2025
@kibanamachine @doakalexi
[8.19] [ResponseOps] Update ES|QL ES query rule for context.grouping …
ecc9740 
…action variable (#220302) (#220385)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[ResponseOps] Update ES|QL ES query rule for context.grouping action
variable (#220302)](#220302)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Alexi
Doak","email":"109488926+doakalexi@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-05-07T14:25:41Z","message":"[ResponseOps]
Update ES|QL ES query rule for context.grouping action variable
(#220302)\n\nFollow on from this PR that was
merged,\nhttps://github.com//pull/213550\n##
Summary\n\nThis PR updates the ES|QL grouping processing to work with
the\n`context.grouping` action variable.\n\n\n### Checklist\n\n- [ ]
[Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n\n\n### To
verify\n1. Create an ES|QL rule with grouping.\n2. In \"active\" and
\"recovered\" action message, use `context.grouping`\nvariable\n3.
Verify that both \"active\" and \"recovered\" alert notifications
contain\ncorrect information\n\nExample if grouping on `host.name` and
`container.id`:\n\n```\n{\n \"grouping\": \"{{context.grouping}}\",\n
\"host.name\": \"{{context.grouping.host.name}}\",\n \"container.id\":
\"{{context.grouping.container.id}}\"\n}\n```","sha":"d72c62c4c0536944fd17eb0a6ff9d83aea72ab61","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","backport:version","v9.1.0","v8.19.0"],"title":"[ResponseOps]
Update ES|QL ES query rule for context.grouping action
variable","number":220302,"url":"https://github.com/elastic/kibana/pull/220302","mergeCommit":{"message":"[ResponseOps]
Update ES|QL ES query rule for context.grouping action variable
(#220302)\n\nFollow on from this PR that was
merged,\nhttps://github.com//pull/213550\n##
Summary\n\nThis PR updates the ES|QL grouping processing to work with
the\n`context.grouping` action variable.\n\n\n### Checklist\n\n- [ ]
[Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n\n\n### To
verify\n1. Create an ES|QL rule with grouping.\n2. In \"active\" and
\"recovered\" action message, use `context.grouping`\nvariable\n3.
Verify that both \"active\" and \"recovered\" alert notifications
contain\ncorrect information\n\nExample if grouping on `host.name` and
`container.id`:\n\n```\n{\n \"grouping\": \"{{context.grouping}}\",\n
\"host.name\": \"{{context.grouping.host.name}}\",\n \"container.id\":
\"{{context.grouping.container.id}}\"\n}\n```","sha":"d72c62c4c0536944fd17eb0a6ff9d83aea72ab61"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/220302","number":220302,"mergeCommit":{"message":"[ResponseOps]
Update ES|QL ES query rule for context.grouping action variable
(#220302)\n\nFollow on from this PR that was
merged,\nhttps://github.com//pull/213550\n##
Summary\n\nThis PR updates the ES|QL grouping processing to work with
the\n`context.grouping` action variable.\n\n\n### Checklist\n\n- [ ]
[Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n\n\n### To
verify\n1. Create an ES|QL rule with grouping.\n2. In \"active\" and
\"recovered\" action message, use `context.grouping`\nvariable\n3.
Verify that both \"active\" and \"recovered\" alert notifications
contain\ncorrect information\n\nExample if grouping on `host.name` and
`container.id`:\n\n```\n{\n \"grouping\": \"{{context.grouping}}\",\n
\"host.name\": \"{{context.grouping.host.name}}\",\n \"container.id\":
\"{{context.grouping.container.id}}\"\n}\n```","sha":"d72c62c4c0536944fd17eb0a6ff9d83aea72ab61"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
@benakansara @kibanamachine
@elasticmachine @akowalska622
[Observability] [Alert] Add context.grouping action variable in SLO B…
73145ca 
…urn rate and ES Query rules (elastic#213550)

Part of elastic#180709

Adds `context.grouping` action variable in the following rules:
- SLO Burn rate rule
- ES Query rule

### Testing
1. Create each rule with group by fields, and with "active" and
"recovered" actions
- for SLO Burn rate rule, group by fields are derived from the SLO so
you need to create SLO with group by fields
- for ES Query rule, use "Grouped over"
2. In "active" and "recovered" action message, use `context.grouping`
variable
3. Ensure that both "active" and "recovered" alert notifications contain
correct information
4. Ensure that the action variables UI in rule form shows
`context.grouping` action variable

Example of action message:

```
{
  "grouping": "{{context.grouping}}",
  "host.name": "{{context.grouping.host.name}}",
  "container.id": "{{context.grouping.container.id}}"
}
```

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025
@doakalexi @akowalska622
[ResponseOps] Update ES|QL ES query rule for context.grouping action …
060effa 
…variable (elastic#220302)

Follow on from this PR that was merged,
elastic#213550
## Summary

This PR updates the ES|QL grouping processing to work with the
`context.grouping` action variable.


### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### To verify
1. Create an ES|QL rule with grouping.
2. In "active" and "recovered" action message, use `context.grouping`
variable
3. Verify that both "active" and "recovered" alert notifications contain
correct information

Example if grouping on `host.name` and `container.id`:

```
{
  "grouping": "{{context.grouping}}",
  "host.name": "{{context.grouping.host.name}}",
  "container.id": "{{context.grouping.container.id}}"
}
```
qn895 pushed a commit to qn895/kibana that referenced this pull request Jun 3, 2025
@benakansara @kibanamachine
@elasticmachine @qn895
[Observability] [Alert] Add context.grouping action variable in SLO B…
c7c74b7 
…urn rate and ES Query rules (elastic#213550)

Part of elastic#180709

Adds `context.grouping` action variable in the following rules:
- SLO Burn rate rule
- ES Query rule

### Testing
1. Create each rule with group by fields, and with "active" and
"recovered" actions
- for SLO Burn rate rule, group by fields are derived from the SLO so
you need to create SLO with group by fields
- for ES Query rule, use "Grouped over"
2. In "active" and "recovered" action message, use `context.grouping`
variable
3. Ensure that both "active" and "recovered" alert notifications contain
correct information
4. Ensure that the action variables UI in rule form shows
`context.grouping` action variable

Example of action message:

```
{
  "grouping": "{{context.grouping}}",
  "host.name": "{{context.grouping.host.name}}",
  "container.id": "{{context.grouping.container.id}}"
}
```

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
qn895 pushed a commit to qn895/kibana that referenced this pull request Jun 3, 2025
@doakalexi @qn895
[ResponseOps] Update ES|QL ES query rule for context.grouping action …
9e5910d 
…variable (elastic#220302)

Follow on from this PR that was merged,
elastic#213550
## Summary

This PR updates the ES|QL grouping processing to work with the
`context.grouping` action variable.


### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### To verify
1. Create an ES|QL rule with grouping.
2. In "active" and "recovered" action message, use `context.grouping`
variable
3. Verify that both "active" and "recovered" alert notifications contain
correct information

Example if grouping on `host.name` and `container.id`:

```
{
  "grouping": "{{context.grouping}}",
  "host.name": "{{context.grouping.host.name}}",
  "container.id": "{{context.grouping.container.id}}"
}
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@doakalexi doakalexi doakalexi left review comments

@pmuellr pmuellr pmuellr approved these changes

@thomheymann thomheymann thomheymann approved these changes

@kdelemme kdelemme kdelemme approved these changes

@jloleysens jloleysens jloleysens approved these changes

@rmyz rmyz rmyz approved these changes

Assignees

@benakansara benakansara

Labels

backport:version Backport to applied version labels release_note:feature Makes this part of the condensed release notes Team:actionable-obs Formerly "obs-ux-management", responsible for SLO, o11y alerting, significant events, & synthetics. Team:obs-ux-infra_services - DEPRECATED DEPRECATED - Use Team:obs-presentation. v8.19.0 v9.1.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Observability] [Alert Context] Streamline the method of saving group information in alert's context

9 participants

@benakansara @elasticmachine @pmuellr @kibanamachine @thomheymann @kdelemme @jloleysens @rmyz @doakalexi