search

elastic / integrations

Elastic Integrations
https://www.elastic.co/integrations
Other
194 stars 422 forks source link

[arista_ngfw] Convert legacy visualizations to Lens #10584

Closed andrewkroh closed 2 months ago

andrewkroh commented 2 months ago

This package contains legacy visualization types that should be converted to Lens. Serverless projects have limited support for legacy visualization types so we need to use Lens in our dashboards.

References

Related

elasticmachine commented 2 months ago

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

pkoutsovasilis commented 2 months ago

@andrewkroh I have prepared a draft PR with the steps described in this issue (ty) but I don't see any changes particular to lens type visualisation. As a matter of fact these were already as lens type. But I see that some searches changed to managed=true maybe that is the reason for this issue?

andrewkroh commented 2 months ago

Maybe it is a false positive. The dashboard (shared in https://github.com/elastic/integrations/issues/10578#issuecomment-2248057130) flagged arista_ngfw as having non-Lens visualizations. Looking at the raw data, it looks like it is the TSVB Markdown viz. I don't actually know if TSVB Markdown is a problem for Serverless projects. https://github.com/elastic/kibana/issues/154307 mentions that there will be Lens parity for TSVB Markdown, but that was some time ago. Let me see if I can find someone that knows.

Link: https://visualization-usage-analytics.kb.us-central1.gcp.cloud.es.io:9243/app/r/s/4nAJf

Screenshot 2024-07-24 at 16 45 39
pkoutsovasilis commented 2 months ago

ok from my short experience with this I can tell that TSVB Markdown visualizations didn't give me the option to edit in Lens, so I feel there is a certain divergence here that may lead to arista being detected as having non-Lens visualizations

andrewkroh commented 2 months ago

We can ignore the TSVB Markdown for now. There isn't a Lens replacement available yet. The package-spec lint checks ignore TSVB Markdown for this reason.

https://github.com/elastic/elastic-package/blob/1fbc6f7f05771d7bf10b6497478fc1beab4b8beb/docs/howto/update_major_package_spec.md#my-dashboard-contains-legacy-visualization-my-visualization-metric-tsvb

Sorry for the false alarm @pkoutsovasilis 🙏 . I will update the filter on dashboard I was using to exclude TSVB markdown.

Internal Slack discussion