[Security Solution] Adjust log level and wording of logs written from rule executors by nikitaindik · Pull Request #252374 · elastic/kibana

nikitaindik · 2026-02-09T15:58:32Z

Resolves: #251211

Summary

We'd like to provide a user-friendly way to view rule execution events to our customers, so that they could do some basic rule execution troubleshooting. To achieve this we are currently working (PR) on improving the "Execution events" tab on the Rule Details page (currently hidden behind a feature flag).

The "Execution events" tab would show execution events logged to event log, filtered by selected log levels. Ideally, we'd like to give users the most helpful information right away (like which indices are queried, how many alerts were created, how many were filtered by exceptions, etc) and let. Currently, we don't log a lot of info useful for customers, but we do log a lot of developer-useful info.

Screenshot of how "Execution events" messages look currently

Screenshot of how "Execution events" would look after we apply changes from this PR (much cleaner)

Changes
This PR adjusts "message" logs written to event log from rule executors:

No new logs added, no information was removed.
Updated log levels: "info" for less technical user-useful info, "debug" for rule execution stages and basic stats, "trace" is for very small details, mostly useful for devs.
Updated the wording to be a bit more UI friendly and consistent.
Edited long log messages to have a summary/most useful piece of info in the first sentence, then details, separated by a newline char. We could show the first line in the "Execution events" table right away and the full message with all the details in the expandable section.

NOTE: You'll need to enable these Advanced Settings in Kibana config to write logs of all levels.

uiSettings.overrides:
  'securitySolution:extendedRuleExecutionLoggingEnabled': true
  'securitySolution:extendedRuleExecutionLoggingMinLevel': 'trace'

elasticmachine · 2026-02-09T16:42:59Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

elasticmachine · 2026-02-09T16:43:01Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2026-02-09T16:43:03Z

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

yctercero · 2026-02-10T00:00:29Z

@vitaliidm I switched reviewers to @dhurley14 as he's leading the effort on our end.

maximpn

@nikitaindik Thanks for improving the event log messages 🙏

I left some comments regarding inconsistencies and still unclear messages. While some of the comments are open-ended mostly we should stick to the document terms and make the messages as simple as possible so our customers may follow the rule execution path when necessary.

maximpn · 2026-02-11T10:05:05Z

    );
  } catch (error) {
-    ruleExecutionLogger.error(error);
+    ruleExecutionLogger.debug(`Error building alert group from sequence\nError: ${error}`);


Shouldn't it be somethting like this Error transforming matched events to alerts\nError: ${error}?

maximpn · 2026-02-11T10:18:26Z

-        ruleExecutionLogger.debug(
-          `ES|QL query request for ${iteration} iteration took: ${esqlSearchDuration}ms`
+        ruleExecutionLogger.trace(
+          `ES|QL query iteration\nIteration: ${iteration}. Search took: ${esqlSearchDuration}ms.`


"took some ms" sounds like a message for the metrics event. I'm OK to leave it as is for now and deligate it to the DE team to decide how to properly handle this.

We'll rework this at a later stage to output a single event with all the metrics at the end of rule execution. I'll create a ticket.

UPD: Created a ticket

maximpn · 2026-02-11T10:19:59Z

+          ruleExecutionLogger.info(
+            `Alerts created: ${bulkCreateResult.createdItemsCount}. Alerts suppressed: ${bulkCreateResult.suppressedItemsCount}.`
          );


We could split this message in two

N alerts has been created

M alerts has been suppressed

Message details could shed more light on the alerts.

maximpn · 2026-02-11T10:38:39Z

-          ruleExecutionLogger.debug(
-            `End of search: Found ${response.values.length} results with page size ${size}`
+          ruleExecutionLogger.trace(
+            `End of search. Found ${response.values.length} results\nPage size ${size}.`


This message doesn't provide clear answers without knowing the executor implementation details. I'd suggest the following

log each found portion size right below response has been fetched. Something like <iteration>: Fetched N source events, page size M

in this if block either log nothing or log that the execution has completed the execution. Checkout Indicator matching rule has completed message as an example.

The main logic of the logs is providing clear an trackable rule execution path. Without the details the path is kind of trivial and looks like fetch source event -> apply exceptions -> generate alerts -> suppress some of the alerts. It means logging messages this way we could make the log really straightforward.

message doesn't provide clear answers without knowing the executor implementation details

Yes, I agree. This seems like a low-level info that's useful to devs, but not users, so I moved it to the trace level.

fetch source event -> apply exceptions -> generate alerts -> suppress some of the alerts

For this sort of high-level logging, I'll add more logs at the INFO level in a follow-up PR.

maximpn · 2026-02-11T11:03:55Z

        // warning should be already set
        ruleExecutionLogger.debug(
-          `Indicator match has reached its max signals count ${
+          `Max alerts per run reached\nIndicator match has reached its max signals count ${


Again signals is used but it seems a to be a non documented term. This message contains a mix of alert and signal terms.

## Summary I accidentally merged a commit in PR [#252168](#252168) that was destined for another PR #252374. 🤦‍♂️ The commit adjusted log levels for rule executors. Opening this PR to revert the unwanted commit.

## Summary I accidentally merged a commit in PR [elastic#252168](elastic#252168) that was destined for another PR elastic#252374. 🤦‍♂️ The commit adjusted log levels for rule executors. Opening this PR to revert the unwanted commit.

elasticmachine · 2026-02-13T19:17:24Z

💔 Build Failed

Buildkite Build
Commit: e414519

Failed CI Steps

Defend Workflows Cypress Tests #1

Metrics [docs]

✅ unchanged

History

💔 Build #394183 failed e414519
💚 Build #392406 succeeded a52bbba
💔 Build #392286 failed c401d62
💔 Build #391976 failed a835e46

cc @nikitaindik

dhurley14

small nits but lgtm

…/detection_engine/rule_types/indicator_match/threat_mapping/create_event_signal.ts Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

…/detection_engine/rule_types/utils/search_after_bulk_create_factory.ts Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

…/detection_engine/rule_types/utils/utils.ts Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

…/detection_engine/rule_types/utils/single_search_after.ts Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

…/detection_engine/rule_types/utils/send_telemetry_events.ts Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

nikitaindik

Thanks for review, everyone! I'll open a follow-up that adds more info-level logging later today.

nikitaindik · 2026-02-12T13:05:45Z

-        `search times of ${results.searchAfterTimes}ms,`,
-        `bulk create times ${results.bulkCreateTimes}ms,`,
-        `all successes are ${results.success}`
+        `Alert candidates found: ${results.createdSignalsCount}.\nConcurrent indicator match searches completed. Search took: ${results.searchAfterTimes}ms. Bulk create times (ms): ${results.bulkCreateTimes}. Are all operations successful: ${results.success}.`


This message is logged in a loop, logs intermediate values and is very technical in general. I think it just makes sense to move this to the trace level, since this info is mostly for devs.

nikitaindik · 2026-02-16T15:14:16Z

-          ruleExecutionLogger.debug(
-            `End of search: Found ${response.values.length} results with page size ${size}`
+          ruleExecutionLogger.trace(
+            `End of search. Found ${response.values.length} results\nPage size ${size}.`


message doesn't provide clear answers without knowing the executor implementation details

Yes, I agree. This seems like a low-level info that's useful to devs, but not users, so I moved it to the trace level.

fetch source event -> apply exceptions -> generate alerts -> suppress some of the alerts

For this sort of high-level logging, I'll add more logs at the INFO level in a follow-up PR.

nikitaindik · 2026-02-19T08:05:24Z

-        ruleExecutionLogger.debug(
-          `ES|QL query request for ${iteration} iteration took: ${esqlSearchDuration}ms`
+        ruleExecutionLogger.trace(
+          `ES|QL query iteration\nIteration: ${iteration}. Search took: ${esqlSearchDuration}ms.`


We'll rework this at a later stage to output a single event with all the metrics at the end of rule execution. I'll create a ticket.

nikitaindik · 2026-02-19T08:07:36Z

+    `Match checks completed\n${
      currentEventList.length
-    } items have completed match checks and the total times to search were ${
+    } items have completed match checks. Search times (ms): ${


Yup. Moved it to trace for now. But we'll rework the approach later based on Marshall's suggestion here. Will create a ticket.

maximpn

@nikitaindik Thanks for addressing my comments 🙏

I'm really excited to see logging segregation based on the Marshall's comment. I'm quite sure APM provides really elaborated tools for toubleshooting.

… rule executors (elastic#252374) **Resolves: elastic#251211 ## Summary We'd like to provide a user-friendly way to view rule execution events to our customers, so that they could do some basic rule execution troubleshooting. To achieve this we are currently working ([PR](elastic#252168)) on improving the "Execution events" tab on the Rule Details page (currently hidden behind a feature flag). The "Execution events" tab would show execution events logged to event log, filtered by selected log levels. Ideally, we'd like to give users the most helpful information right away (like which indices are queried, how many alerts were created, how many were filtered by exceptions, etc) and let. Currently, we don't log a lot of info useful for customers, but we do log a lot of developer-useful info. <details> <summary>Screenshot of how "Execution events" messages look currently</summary> <img width="2932" height="675" alt="Screenshot 2026-02-09 at 17 33 56" src="https://github.com/user-attachments/assets/5ec58dd8-6032-49f3-83ec-bfbd13a6fa03" /> </details> <details> <summary>Screenshot of how "Execution events" would look after we apply changes from this PR (much cleaner)</summary> <img width="2291" height="854" alt="Screenshot 2026-02-12 at 12 07 04" src="https://github.com/user-attachments/assets/da74a5da-e6d5-4a07-885c-39ed3a55a132" /> </details> **Changes** This PR adjusts "message" logs written to event log from rule executors: - No new logs added, no information was removed. - Updated log levels: "info" for less technical user-useful info, "debug" for rule execution stages and basic stats, "trace" is for very small details, mostly useful for devs. - Updated the wording to be a bit more UI friendly and consistent. - Edited long log messages to have a summary/most useful piece of info in the first sentence, then details, separated by a newline char. We could show the first line in the "Execution events" table right away and the full message with all the details in the expandable section. > **NOTE**: You'll need to enable these Advanced Settings in Kibana config to write logs of all levels. ``` uiSettings.overrides: 'securitySolution:extendedRuleExecutionLoggingEnabled': true 'securitySolution:extendedRuleExecutionLoggingMinLevel': 'trace' ``` --------- Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

nikitaindik self-assigned this Feb 9, 2026

nikitaindik changed the title ~~[Security Solution] Adjust log level and wording of "message" events~~ [Security Solution] Adjust log level and wording of logs written from rule executors Feb 9, 2026

nikitaindik marked this pull request as ready for review February 9, 2026 16:42

nikitaindik requested a review from a team as a code owner February 9, 2026 16:42

nikitaindik requested a review from vitaliidm February 9, 2026 16:42

nikitaindik requested a review from maximpn February 9, 2026 16:43

yctercero requested review from dhurley14 and removed request for vitaliidm February 10, 2026 00:00

nikitaindik force-pushed the update-executor-logging branch 2 times, most recently from c401d62 to a52bbba Compare February 10, 2026 11:11

maximpn reviewed Feb 11, 2026

View reviewed changes

nikitaindik force-pushed the update-executor-logging branch from a52bbba to 7600c4a Compare February 12, 2026 14:34

nikitaindik mentioned this pull request Feb 12, 2026

[Security Solution] Revert accidentally merged commit #252895

Merged

nikitaindik force-pushed the update-executor-logging branch from 7600c4a to e414519 Compare February 12, 2026 19:11

dhurley14 approved these changes Feb 18, 2026

View reviewed changes

nikitaindik and others added 7 commits February 19, 2026 08:58

Adjust log level and wording of "message" events

a42e84f

Update levels in a few logs

1e1e8d4

Update x-pack/solutions/security/plugins/security_solution/server/lib…

d1a047d

…/detection_engine/rule_types/indicator_match/threat_mapping/create_event_signal.ts Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

Update x-pack/solutions/security/plugins/security_solution/server/lib…

eb724e9

…/detection_engine/rule_types/utils/search_after_bulk_create_factory.ts Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

Update x-pack/solutions/security/plugins/security_solution/server/lib…

faaaa19

…/detection_engine/rule_types/utils/utils.ts Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

Update x-pack/solutions/security/plugins/security_solution/server/lib…

5da5c1b

…/detection_engine/rule_types/utils/single_search_after.ts Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

Update x-pack/solutions/security/plugins/security_solution/server/lib…

c61ab66

…/detection_engine/rule_types/utils/send_telemetry_events.ts Co-authored-by: Devin W. Hurley <snowmiser111@gmail.com>

nikitaindik force-pushed the update-executor-logging branch from 7456152 to c61ab66 Compare February 19, 2026 08:03

nikitaindik added 2 commits February 19, 2026 09:14

Update cycle number logging

5eeb70e

Push a suggestion from Maxim

ff8dfd0

nikitaindik commented Feb 19, 2026

View reviewed changes

nikitaindik requested a review from maximpn February 19, 2026 08:17

maximpn approved these changes Feb 19, 2026

View reviewed changes

nikitaindik merged commit a6b9d4b into elastic:main Feb 19, 2026
16 checks passed

nikitaindik mentioned this pull request Feb 24, 2026

[Request] Document the new "Execution Events" tab on Rule Details page elastic/docs-content#5282

Closed

Conversation

nikitaindik commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

yctercero commented Feb 10, 2026

Uh oh!

maximpn left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Metrics [docs]

History

Uh oh!

dhurley14 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nikitaindik left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

maximpn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

nikitaindik commented Feb 9, 2026 •

edited

Loading

elasticmachine commented Feb 13, 2026 •

edited

Loading