[Custom threshold][Alert details page] Hiding Log rate analysis for no data alerts

elastic / kibana

Your window into the Elastic Stack

https://www.elastic.co/products/kibana

Other

19.48k stars 8.04k forks source link

[Custom threshold][Alert details page] Hiding Log rate analysis for no data alerts #185866

Open maryam-saeidi opened 3 weeks ago

maryam-saeidi commented 3 weeks ago

Summary

In case of a no data alert, there is no document to use in Log rate analysis, so we should hide this component in that scenario:

Questions

A similar scenario is applicable for document count < 1, shall we cover that scenario as well? My answer would be to check both 0 and null values.
How do we know if an alert has no data? If I remember correctly, we don't save that information in AAD currently, maybe we can decide based on observed value.
How about the scenario that we had an alert first (agg: document count < 10), then it turned to no data? If we decide based on observed value, in this case, we will not show the Log rate analysis component, which seems correct to me.

elasticmachine commented 3 weeks ago

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

maryam-saeidi commented 3 weeks ago

@jasonrhodes @benakansara @fkanout I've added some questions in the description of this ticket with my thoughts, if you have other ideas, please let me know. If you think it is clear what we need to do in this ticket, I will move it to ready then.

jasonrhodes commented 3 weeks ago

How do we know if an alert has no data? If I remember correctly, we don't save that information in AAD currently, maybe we can decide based on observed value.

I suspect we need to fix this broadly because looking at this screenshot, I'm already realizing that it's not clear to me that this alert triggered due to not finding data rather than due to it being a violation of the criteria I set up. That feels like it would lead to a lot of confusion? I know this is related to "we should move 'no data' out of our individual rule executions and make it a rule platform thing" ...