From 307fe3f7eeb9f65b4432085e1c7a595aa08bff6e Mon Sep 17 00:00:00 2001 From: Faisal Kanout Date: Fri, 24 Nov 2023 15:06:37 +0100 Subject: [PATCH 1/2] Fix IS_NOT_BETWEEN comparator for the custom threshold, Infra, Metric rules --- .../inventory_metric_threshold/lib/create_condition_script.ts | 3 ++- .../alerting/metric_threshold/lib/create_condition_script.ts | 3 ++- .../lib/rules/custom_threshold/lib/create_condition_script.ts | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/lib/create_condition_script.ts b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/lib/create_condition_script.ts index 37a39d215eddd..a62f5d92dac06 100644 --- a/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/lib/create_condition_script.ts +++ b/x-pack/plugins/infra/server/lib/alerting/inventory_metric_threshold/lib/create_condition_script.ts @@ -25,7 +25,8 @@ export const createConditionScript = ( } if (comparator === Comparator.OUTSIDE_RANGE && threshold.length === 2) { return { - source: `params.value < params.threshold0 && params.value > params.threshold1 ? 1 : 0`, + // OUTSIDE_RANGE/NOT BETWEEN is the opposite of BETWEEN. Use the BETWEEN condition and switch the 1 and 0 + source: `params.value > params.threshold0 && params.value < params.threshold1 ? 0 : 1`, params: { threshold0: threshold[0], threshold1: threshold[1], diff --git a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/create_condition_script.ts b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/create_condition_script.ts index b4285863dbccb..1320607685a87 100644 --- a/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/create_condition_script.ts +++ b/x-pack/plugins/infra/server/lib/alerting/metric_threshold/lib/create_condition_script.ts @@ -18,7 +18,8 @@ export const createConditionScript = (threshold: number[], comparator: Comparato } if (comparator === Comparator.OUTSIDE_RANGE && threshold.length === 2) { return { - source: `params.value < params.threshold0 && params.value > params.threshold1 ? 1 : 0`, + // OUTSIDE_RANGE/NOT BETWEEN is the opposite of BETWEEN. Use the BETWEEN condition and switch the 1 and 0 + source: `params.value > params.threshold0 && params.value < params.threshold1 ? 0 : 1`, params: { threshold0: threshold[0], threshold1: threshold[1], diff --git a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_condition_script.ts b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_condition_script.ts index ad4aaa980aa63..2e5eda9fa32b4 100644 --- a/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_condition_script.ts +++ b/x-pack/plugins/observability/server/lib/rules/custom_threshold/lib/create_condition_script.ts @@ -19,7 +19,8 @@ export const createConditionScript = (threshold: number[], comparator: Comparato } if (comparator === Comparator.OUTSIDE_RANGE && threshold.length === 2) { return { - source: `params.value < params.threshold0 && params.value > params.threshold1 ? 1 : 0`, + // OUTSIDE_RANGE/NOT BETWEEN is the opposite of BETWEEN. Use the BETWEEN condition and switch the 1 and 0 + source: `params.value > params.threshold0 && params.value < params.threshold1 ? 0 : 1`, params: { threshold0: threshold[0], threshold1: threshold[1], From 1b7714f7d31e08e9fb4671b1ccb942113fc361d6 Mon Sep 17 00:00:00 2001 From: Faisal Kanout Date: Mon, 27 Nov 2023 14:56:10 +0100 Subject: [PATCH 2/2] Use IS NOT BETWEEN --- .../custom_threshold_rule/documents_count_fired.ts | 10 +++++----- .../custom_threshold_rule/documents_count_fired.ts | 8 ++++---- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/documents_count_fired.ts b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/documents_count_fired.ts index a602dc9012850..a1057e4ed6f74 100644 --- a/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/documents_count_fired.ts +++ b/x-pack/test/alerting_api_integration/observability/custom_threshold_rule/documents_count_fired.ts @@ -91,8 +91,8 @@ export default function ({ getService }: FtrProviderContext) { params: { criteria: [ { - comparator: Comparator.GT, - threshold: [2], + comparator: Comparator.OUTSIDE_RANGE, + threshold: [1, 2], timeSize: 1, timeUnit: 'm', metrics: [{ name: 'A', filter: '', aggType: Aggregators.COUNT }], @@ -186,8 +186,8 @@ export default function ({ getService }: FtrProviderContext) { .eql({ criteria: [ { - comparator: '>', - threshold: [2], + comparator: Comparator.OUTSIDE_RANGE, + threshold: [1, 2], timeSize: 1, timeUnit: 'm', metrics: [{ name: 'A', filter: '', aggType: 'count' }], @@ -211,7 +211,7 @@ export default function ({ getService }: FtrProviderContext) { `https://localhost:5601/app/observability/alerts?_a=(kuery:%27kibana.alert.uuid:%20%22${alertId}%22%27%2CrangeFrom:%27${rangeFrom}%27%2CrangeTo:now%2Cstatus:all)` ); expect(resp.hits.hits[0]._source?.reason).eql( - `Document count is 3, above the threshold of 2. (duration: 1 min, data view: ${DATE_VIEW_NAME})` + `Document count is 3, not between the threshold of 1 and 2. (duration: 1 min, data view: ${DATE_VIEW_NAME})` ); expect(resp.hits.hits[0]._source?.value).eql('3'); }); diff --git a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/documents_count_fired.ts b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/documents_count_fired.ts index 01f04b12f0c50..453da41b81196 100644 --- a/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/documents_count_fired.ts +++ b/x-pack/test_serverless/api_integration/test_suites/observability/custom_threshold_rule/documents_count_fired.ts @@ -84,8 +84,8 @@ export default function ({ getService }: FtrProviderContext) { params: { criteria: [ { - comparator: Comparator.GT, - threshold: [2], + comparator: Comparator.OUTSIDE_RANGE, + threshold: [1, 2], timeSize: 1, timeUnit: 'm', metrics: [{ name: 'A', filter: '', aggType: Aggregators.COUNT }], @@ -176,8 +176,8 @@ export default function ({ getService }: FtrProviderContext) { .eql({ criteria: [ { - comparator: '>', - threshold: [2], + comparator: Comparator.OUTSIDE_RANGE, + threshold: [1, 2], timeSize: 1, timeUnit: 'm', metrics: [{ name: 'A', filter: '', aggType: 'count' }],