search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.69k stars 8.12k forks source link

[event log] add a new 'kibana.connector' object property to the event log documents #109659

Open pmuellr opened 3 years ago

pmuellr commented 3 years ago

We have the luxury of ECS's rule property to fill in details about alerting rules:

https://github.com/elastic/kibana/blob/6a61c43f06a87936f68dbc357bb6f5be06e5dbe3/x-pack/plugins/event_log/generated/mappings.json#L173-L219

However, we do NOT have an equivalent place to store connector information. Ideally, we'd be storing the rule id, space ids, name at a minimum. This would allow us to search over these fields. Today, you can do some unwieldy searches over connectors via the kibana.saved_objects nested fields, but runtime field access can get slow, especially when filtering fields (checking every document); and having the name available for alerting rules has ended up working out well for diagnostics:

https://github.com/elastic/kibana/blob/6e3af2b5240532faf4a29edc0d1769d87bd43957/x-pack/plugins/event_log/generated/mappings.json#L270-L294

elasticmachine commented 3 years ago

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)