add ordering + bigger bucket for the KPI

elastic · Oct 7, 2022 · 8de7195 · 8de7195
1 parent 4e9a16a
commit 8de7195
Show file tree

Hide file tree

Showing 3 changed files with 48 additions and 11 deletions.
diff --git a/x-pack/plugins/alerting/server/lib/get_execution_log_aggregation.test.ts b/x-pack/plugins/alerting/server/lib/get_execution_log_aggregation.test.ts
@@ -1711,13 +1711,18 @@ describe('getExecutionKPIAggregation', () => {
           executionUuid: {
             terms: {
               field: 'kibana.alert.rule.execution.uuid',
-              size: 1000,
+              order: [
+                {
+                  'ruleExecution>executeStartTime': 'desc',
+                },
+              ],
+              size: 10000,
             },
             aggs: {
               executionUuidSorted: {
                 bucket_sort: {
                   from: 0,
-                  size: 1000,
+                  size: 10000,
                   gap_policy: 'insert_zeros',
                 },
               },
@@ -1777,6 +1782,11 @@ describe('getExecutionKPIAggregation', () => {
                   },
                 },
                 aggs: {
+                  executeStartTime: {
+                    min: {
+                      field: 'event.start',
+                    },
+                  },
                   numTriggeredActions: {
                     sum: {
                       field: 'kibana.alert.rule.execution.metrics.number_of_triggered_actions',
@@ -1850,13 +1860,18 @@ describe('getExecutionKPIAggregation', () => {
           executionUuid: {
             terms: {
               field: 'kibana.alert.rule.execution.uuid',
-              size: 1000,
+              order: [
+                {
+                  'ruleExecution>executeStartTime': 'desc',
+                },
+              ],
+              size: 10000,
             },
             aggs: {
               executionUuidSorted: {
                 bucket_sort: {
                   from: 0,
-                  size: 1000,
+                  size: 10000,
                   gap_policy: 'insert_zeros',
                 },
               },
@@ -1928,6 +1943,11 @@ describe('getExecutionKPIAggregation', () => {
                   },
                 },
                 aggs: {
+                  executeStartTime: {
+                    min: {
+                      field: 'event.start',
+                    },
+                  },
                   numTriggeredActions: {
                     sum: {
                       field: 'kibana.alert.rule.execution.metrics.number_of_triggered_actions',
@@ -2001,13 +2021,18 @@ describe('getExecutionKPIAggregation', () => {
           executionUuid: {
             terms: {
               field: 'kibana.alert.rule.execution.uuid',
-              size: 1000,
+              order: [
+                {
+                  'ruleExecution>executeStartTime': 'desc',
+                },
+              ],
+              size: 10000,
             },
             aggs: {
               executionUuidSorted: {
                 bucket_sort: {
                   from: 0,
-                  size: 1000,
+                  size: 10000,
                   gap_policy: 'insert_zeros',
                 },
               },
@@ -2079,6 +2104,11 @@ describe('getExecutionKPIAggregation', () => {
                   },
                 },
                 aggs: {
+                  executeStartTime: {
+                    min: {
+                      field: 'event.start',
+                    },
+                  },
                   numTriggeredActions: {
                     sum: {
                       field: 'kibana.alert.rule.execution.metrics.number_of_triggered_actions',

diff --git a/x-pack/plugins/alerting/server/lib/get_execution_log_aggregation.ts b/x-pack/plugins/alerting/server/lib/get_execution_log_aggregation.ts
@@ -15,6 +15,7 @@ import { parseDuration } from '.';
 import { IExecutionLog, IExecutionLogResult, EMPTY_EXECUTION_KPI_RESULT } from '../../common';
 
 const DEFAULT_MAX_BUCKETS_LIMIT = 1000; // do not retrieve more than this number of executions
+const DEFAULT_MAX_KPI_BUCKETS_LIMIT = 10000;
 
 const RULE_ID_FIELD = 'rule.id';
 const RULE_NAME_FIELD = 'rule.name';
@@ -148,13 +149,14 @@ export const getExecutionKPIAggregation = (filter?: IExecutionLogAggOptions['fil
           // Bucket by execution UUID
           terms: {
             field: EXECUTION_UUID_FIELD,
-            size: DEFAULT_MAX_BUCKETS_LIMIT,
+            size: DEFAULT_MAX_KPI_BUCKETS_LIMIT,
+            order: formatSortForTermSort([{ timestamp: { order: 'desc' } }]),
           },
           aggs: {
             executionUuidSorted: {
               bucket_sort: {
                 from: 0,
-                size: 1000,
+                size: DEFAULT_MAX_KPI_BUCKETS_LIMIT,
                 gap_policy: 'insert_zeros' as estypes.AggregationsGapPolicy,
               },
             },
@@ -181,6 +183,11 @@ export const getExecutionKPIAggregation = (filter?: IExecutionLogAggOptions['fil
                 },
               },
               aggs: {
+                executeStartTime: {
+                  min: {
+                    field: START_FIELD,
+                  },
+                },
                 numTriggeredActions: {
                   sum: {
                     field: 'kibana.alert.rule.execution.metrics.number_of_triggered_actions',

diff --git a/...ctions_ui/public/application/sections/rule_details/components/rule_event_log_list_kpi.tsx b/...ctions_ui/public/application/sections/rule_details/components/rule_event_log_list_kpi.tsx
@@ -35,21 +35,21 @@ const API_FAILED_MESSAGE = i18n.translate(
 const RESPONSE_TOOLTIP = i18n.translate(
   'xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.responseTooltip',
   {
-    defaultMessage: 'The responses for the latest rule runs.',
+    defaultMessage: 'The responses for up to 10,000 most recent rule runs.',
   }
 );
 
 const ALERTS_TOOLTIP = i18n.translate(
   'xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.alertsTooltip',
   {
-    defaultMessage: 'The alert statuses for the latest rule runs.',
+    defaultMessage: 'The alert statuses for up to 10,000 most recent rule runs.',
   }
 );
 
 const ACTIONS_TOOLTIP = i18n.translate(
   'xpack.triggersActionsUI.sections.ruleDetails.ruleEventLogListKpi.actionsTooltip',
   {
-    defaultMessage: 'The action statuses for the latest rule runs.',
+    defaultMessage: 'The action statuses for up to 10,000 most recent rule runs.',
   }
 );