Skip to content

Add kibana.alert.grouping field to SLO burn rate rule #228754

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mgiota merged 19 commits into from
Jul 29, 2025
Merged

Add kibana.alert.grouping field to SLO burn rate rule #228754

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
a7b4beb
add kibana.alert.grouping to slo burn rate rule
mgiota Jul 21, 2025
9fb4f8d
fix ES error
mgiota Jul 22, 2025
be4c8ea
Merge branch 'main' into slo_burn_rate_rule_grouping
elasticmachine Jul 22, 2025
3585620
[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…
kibanamachine Jul 22, 2025
ed6170a
fix failing tests
mgiota Jul 23, 2025
35e8a2e
remove unknown
mgiota Jul 23, 2025
723acf0
Merge branch 'main' into slo_burn_rate_rule_grouping
elasticmachine Jul 23, 2025
4c315f5
create getEcsGroupings to use groupings object instead of groups array
mgiota Jul 23, 2025
0100b34
move new function in a new file
mgiota Jul 23, 2025
6311c90
add tests for getEcsGroupings function
mgiota Jul 23, 2025
db2cfd4
fix failing integration tests
mgiota Jul 23, 2025
3ec0a3e
Merge branch 'main' of github.com:elastic/kibana into slo_burn_rate_r…
mgiota Jul 24, 2025
1fbadcf
add a test case that handles both ecs and non-ecs fields
mgiota Jul 24, 2025
968fe95
pr feedback
mgiota Jul 24, 2025
1bef755
Merge branch 'main' into slo_burn_rate_rule_grouping
elasticmachine Jul 24, 2025
dcc4b51
Merge branch 'main' into slo_burn_rate_rule_grouping
elasticmachine Jul 25, 2025
7b1d5b4
remove unused type
mgiota Jul 25, 2025
0434fb3
Merge branch 'main' into slo_burn_rate_rule_grouping
elasticmachine Jul 25, 2025
8d29ffa
Merge branch 'main' into slo_burn_rate_rule_grouping
elasticmachine Jul 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 11 additions & 13 deletions x-pack/solutions/observability/plugins/slo/server/lib/rules/slo_burn_rate/executor.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,17 @@
*/

import numeral from '@elastic/numeral';
import { flattenObject } from '@kbn/object-utils';
import { AlertsClientError, ExecutorType, RuleExecutorOptions } from '@kbn/alerting-plugin/server';
import { ObservabilitySloAlert } from '@kbn/alerts-as-data-utils';
import { IBasePath } from '@kbn/core/server';
import { i18n } from '@kbn/i18n';
import { getEcsGroups } from '@kbn/alerting-rule-utils';
import { getEcsGroups, getFormattedGroups } from '@kbn/alerting-rule-utils';
import { getAlertDetailsUrl } from '@kbn/observability-plugin/common';
import {
ALERT_EVALUATION_THRESHOLD,
ALERT_EVALUATION_VALUE,
ALERT_GROUPING,
ALERT_GROUP,
ALERT_REASON,
} from '@kbn/rule-data-utils';
Expand Down Expand Up @@ -50,6 +52,7 @@ import {
WindowSchema,
} from './types';

// should I add ALERT_GROUPING here?

@kdelemme kdelemme Jul 22, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if the alertClient does not complain i think it's fine to keep it as it is

export type BurnRateAlert = Omit<ObservabilitySloAlert, 'kibana.alert.group'> & {
[ALERT_GROUP]?: Group[];
};
Expand Down Expand Up @@ -122,14 +125,11 @@ export const getRuleExecutor = (basePath: IBasePath) =>
window: windowDef,
} = result;

const instances = instanceId.split(',');
const groups =
instanceId !== ALL_VALUE
? [slo.groupBy].flat().reduce<Group[]>((resultGroups, groupByItem, index) => {
resultGroups.push({ field: groupByItem, value: instances[index].trim() });
return resultGroups;
}, [])
: undefined;
const groupingsFlattened = flattenObject(groupings ?? {});
const groupingsFlattenedString = Object.fromEntries(
Comment thread
benakansara marked this conversation as resolved.
Outdated
Object.entries(groupingsFlattened).map(([key, value]) => [key, String(value)])
);
const groups = getFormattedGroups(groupingsFlattenedString);

const urlQuery = instanceId === ALL_VALUE ? '' : `?instanceId=${instanceId}`;
const viewInAppUrl = addSpaceIdToPath(
Expand Down Expand Up @@ -168,13 +168,13 @@ export const getRuleExecutor = (basePath: IBasePath) =>
actionGroup,
state: {
alertState: AlertStates.ALERT,
grouping: groupings,
},
payload: {
[ALERT_REASON]: reason,
[ALERT_EVALUATION_THRESHOLD]: windowDef.burnRateThreshold,
[ALERT_EVALUATION_VALUE]: Math.min(longWindowBurnRate, shortWindowBurnRate),
[ALERT_GROUP]: groups,
[ALERT_GROUPING]: groupings, // Object, example: { host: { name: 'host-0' } }
[SLO_ID_FIELD]: slo.id,
[SLO_REVISION_FIELD]: slo.revision,
[SLO_INSTANCE_ID_FIELD]: instanceId,
Comment thread
benakansara marked this conversation as resolved.
Expand Down Expand Up @@ -226,16 +226,14 @@ export const getRuleExecutor = (basePath: IBasePath) =>
`/app/observability/slos/${slo.id}${urlQuery}`
);

const recoveredAlertState = recoveredAlert.alert.getState();

const context = {
timestamp: startedAt.toISOString(),
viewInAppUrl,
alertDetailsUrl,
sloId: slo.id,
sloName: slo.name,
sloInstanceId: alertId,
grouping: recoveredAlertState?.grouping,
grouping: recoveredAlert.hit?.[ALERT_GROUPING],
};

alertsClient.setAlertData({
Expand Down
19 changes: 18 additions & 1 deletion x-pack/solutions/observability/plugins/slo/server/lib/rules/slo_burn_rate/register.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,24 @@ export function sloBurnRateRuleType(
},
alerts: {
context: SLO_RULE_REGISTRATION_CONTEXT,
mappings: { fieldMap: { ...legacyExperimentalFieldMap, ...sloRuleFieldMap } },
mappings: {
fieldMap: {
...legacyExperimentalFieldMap,
...sloRuleFieldMap,
},
dynamicTemplates: [
{
strings_as_keywords: {
path_match: 'kibana.alert.grouping.*',
match_mapping_type: 'string',
mapping: {
type: 'keyword' as const,
ignore_above: 1024,
},
},
},
],
},
useEcs: true,
useLegacyAlerts: true,
shouldWrite: true,
Expand Down