[ResponseOps] improve query-result-out-of-time-range
message in ES Query rule
#200023
Labels
Feature:Alerting/RuleTypes
Issues related to specific Alerting Rules Types
Feature:Alerting
Team:ResponseOps
Label for the ResponseOps team (formerly the Cases and Alerting teams)
The ES Query rule type has some processing to try to catch the case where it is returning documents outside the time range being searched for, as part of investigating #175980:
kibana/x-pack/plugins/stack_alerts/server/rule_types/es_query/executor.ts
Lines 259 to 267 in 4ad25cf
There are a few problems with this:
fields
for the time field instead. The source field can be all sorts of wacky formats, thefields
value seems to be an ISO datefields
time field (as noted above)timeField
seems like it will generally be filled in, but is in fact not used (time field is saved in the data view), and I've seen cases where the rule'stimeField
is different than what the data view uses)Suggestions:
The text was updated successfully, but these errors were encountered: