Skip to content

[8.19] Register recommended ES|QL queries for Observability (#224054)#224861

Merged
kibanamachine merged 1 commit intoelastic:8.19from
kibanamachine:backport/8.19/pr-224054
Jun 23, 2025
Merged

[8.19] Register recommended ES|QL queries for Observability (#224054)#224861
kibanamachine merged 1 commit intoelastic:8.19from
kibanamachine:backport/8.19/pr-224054

Conversation

@kibanamachine
Copy link
Contributor

Backport

This will backport the following commits from main to 8.19:

Questions ?

Please refer to the Backport tool documentation

## Summary
This PRs builds on top of the [extension point added to the E|QL
editor](elastic#221474) by registering
recommended ES|QL queries from the Observability plugin.

It registers two recommended queries for logs and two for metrics:
- Kubernetes pods sorted by memory usage
- Kubernetes pods sorted by CPU usage
- Logs with "error" or "warn" messages
- Error occurrences by host name

### Demo - Solution navigation enabled

https://github.com/user-attachments/assets/ca06b89b-5574-4775-8beb-157fa1eaa97a

### Demo - Solution navigation disabled
Only the default recommended ES|QL queries are enabled in this mode.

https://github.com/user-attachments/assets/52043076-6467-44fa-a847-937d3e723afc

## Testing instructions
There is an environment deployed with `/oblt-deploy` that has logs and
metrics (check last month in Discover), you can find the credentials in
the issue posted by the bot in the issue timeline below

For local testing:
- Ingest logs and metrics. This can be done by running a Synthtrace
scenario, e.g. `node scripts/synthtrace.js logs_traces_hosts`
- Enable the Observability solution navigation
- Start writing an ES|QL query targeting indices that match the `logs-*`
or `metrics-*` patterns

## Open questions
- Should the `KQL` command be used in the queries?

Closes elastic#224027

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit 3a23553)
@kibanamachine kibanamachine added the backport This PR is a backport of another PR label Jun 23, 2025
@botelastic botelastic bot added the Team:actionable-obs Formerly "obs-ux-management", responsible for SLO, o11y alerting, significant events, & synthetics. label Jun 23, 2025
@kibanamachine kibanamachine enabled auto-merge (squash) June 23, 2025 12:15
@elasticmachine
Copy link
Contributor

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

@kibanamachine kibanamachine merged commit 080b86e into elastic:8.19 Jun 23, 2025
13 checks passed
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

cc @gbamparop

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR Team:actionable-obs Formerly "obs-ux-management", responsible for SLO, o11y alerting, significant events, & synthetics.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants