Skip to content

[8.x] [ResponseOps][Rules] Ignore unknowns in the schema of the log threshold params (#217440) #217526

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 8, 2025

Conversation

kibanamachine
Copy link
Contributor

Backport

This will backport the following commits from main to 8.x:

Questions ?

Please refer to the Backport tool documentation

…ld params (elastic#217440)

## Summary

A PR introduced into 8.18/9.0
(elastic#205507) changed the way we
validate the log threshold rule type parameters. The validation happens
on rule params and changes a loose validation to a strict validation, so
those users who’ve inserted excess fields before 8.18/9.0 will see rules
starting to fail to run, their rule page failing to load and the API
starting to reject calls with excess fields.

Fixes: elastic#217384

## Testing instructions

1. Start Kibana on 8.17 and create the following rule using the API. Let
the rule run.

<details><summary>Rule</summary>

```
{
    "name": "[QAF] Observability rule 3",
    "tags": [
        "metrics",
        "threshold",
        "qaf"
    ],
    "rule_type_id": "logs.alert.document.count",
    "consumer": "alerts",
    "schedule": {
        "interval": "1m"
    },
    "actions": [],
    "params": {
        "timeSize": 8,
        "timeUnit": "h",
        "count": {
            "value": 1,
            "comparator": "more than"
        },
        "criteria": [
            {
                "field": "bytes",
                "comparator": "more than",
                "value": 1
            }
        ],
        "logView": {
            "logViewId": "log-view-reference-0",
            "type": "log-view-reference"
        },
        "groupBy": [
            "geo.dest"
        ],
        "outputIndex": ".alerts-observability.logs.alerts-default"
    }
}
```

</details>

2. Start Kibana on 8.18. Verify that you cannot create the same rule and
the rule created in step 1 starts failing.
3. Start Kibana on this PR and that you can create the same rule and the
rule created in step 1 is working as expected.

### Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit 2a01722)
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

cc @cnasikas

@kibanamachine kibanamachine merged commit 8bdecd6 into elastic:8.x Apr 8, 2025
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants