Skip to content

[8.19] [ResponseOps][Cases] Populate total alerts and comments in the cases saved objects (#223992)#224928

Merged
cnasikas merged 3 commits intoelastic:8.19from
cnasikas:backport/8.19/pr-223992
Jun 23, 2025
Merged

[8.19] [ResponseOps][Cases] Populate total alerts and comments in the cases saved objects (#223992)#224928
cnasikas merged 3 commits intoelastic:8.19from
cnasikas:backport/8.19/pr-223992

Conversation

@cnasikas
Copy link
Member

Backport

This will backport the following commits from main to 8.19:

Questions ?

Please refer to the Backport tool documentation

…saved objects (elastic#223992)

## Summary

This is a farewell PR to Cases. Probably my last PR to the cases
codebase. It was quite a journey, and I learned a lot. I hope the best
for the feature of Cases.

## Decisions

Just before Cases was forbidden to do migrations, we did a last
migration to all cases to persist `total_alerts: -1` and
`total_comments: -1`. We did that so that in the future, when we would
want to populate the fields, we would know which cases have their fields
populated and which do not. In this PR, due to time constraints and
criticality of the feature, I took the following decisions:

- Cases return from their APIs the total comments and alerts of each
case. They do that by doing an aggregation, getting the counts, and
merging them with the response. I did not change that behavior. In
following PRs, it can be optimized and fetch the stats only for cases
that do not yet have their stats populated (cases with -1 in the counts)
- When a case is created, the counts are zero.
- When a comment or alert is added, I do an aggregation to get the stats
(total alerts and comments) of the current case, and then update the
counters with the number of the newly created attachments. The case is
updated without version checks. In race conditions, where an attachment
is being added before updating the case, the numbers could be off. This
is a deliberate choice. It can be fixed later with retries and version
concurrency control.
- The case service will continue to not return the `total_alerts` and
`total_comments`.
- The case service will accept the `total_alerts` and `total_comments`
attributes to be able to set them.

Fixes: elastic#217636

cc @michaelolo24

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit f30335a)

# Conflicts:
#	x-pack/platform/plugins/shared/cases/server/client/cases/get.ts
@cnasikas cnasikas requested a review from kibanamachine as a code owner June 23, 2025 17:10
@cnasikas cnasikas added the backport This PR is a backport of another PR label Jun 23, 2025
@cnasikas cnasikas enabled auto-merge (squash) June 23, 2025 17:10
@cnasikas cnasikas merged commit 3a23a20 into elastic:8.19 Jun 23, 2025
8 checks passed
@cnasikas cnasikas deleted the backport/8.19/pr-223992 branch June 23, 2025 21:55
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants