search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.69k stars 8.12k forks source link

[ResponseOps] allow connectors and rules to add data to event log execution doc #159032

Open pmuellr opened 1 year ago

pmuellr commented 1 year ago

In PR https://github.com/elastic/kibana/pull/158508 , the event log has been extended to store data from a specific connector for the execution document. Because we don't have a generic way of doing this, the code had to be added to the framework, and not connector. We should figure out how we can do this without changing the framework.

Perhaps connectors / rules can pass back an ECS document structure with values they want added?

Once we have this capability, we should change the gen_ai connector to use this method, and remove the framework code added in the PR #158508.

elasticmachine commented 1 year ago

Pinging @elastic/response-ops (Team:ResponseOps)

pmuellr commented 1 year ago

We can use the same approach here - https://github.com/elastic/kibana/pull/158404/files#diff-f0d40588ca2cab954274ab1f5ec0efa4bf1e0116601ce62b822b1c36846595a9 - to allow types to return an EL doc, but we'll have the framework stuff "protected". Pretty much everything would be "protected" except for the new gen_ai fields.