-
Notifications
You must be signed in to change notification settings - Fork 8.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[EventLog] make use of EQL in event log query #68641
Comments
Pinging @elastic/kibana-alerting-services (Team:Alerting Services) |
EQL would let you do searches over a sequence of events, which seems like it could be useful: I was actually thinking of trying to use it to capture the new-instance / recovered-instance pairs, but I didn't get far into that. Probably worth closing though. I don't think we have any requirement for it that I know of. |
While working on PR #57446, I noticed in the weekly ES updates a note about EQL, and decided to take a look:
I think we can take advantage of this in some follow-on work to the PR referenced above. That PR is adding a new API to get alert "status", but is consuming a potentially large number of event log documents from a flat time-based query. It seems likely we could create an EQL query to do some of this work for us, cutting down on the amount of data transferred and perhaps making the semantics a bit clearer (in EQL instead of TS).
One particular example that would be nice to "solve", is when a missing
resolved-instance
message would get lost, the referenced PR will end up reporting that instance as active. You can "see" looking at the documents that it's not really active, if there have been multipleexecute
documents since the lastactive-instance
message, but that's difficult to precisely describe in JS whereas might be pretty easy to describe as an EQL sequenceThe text was updated successfully, but these errors were encountered: