Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DOCS][8.4] Fallback to @timestamp is configurable when timestamp override is defined #2196

Closed
Tracked by #2258
e40pud opened this issue Jul 13, 2022 · 1 comment · Fixed by #2339
Closed
Tracked by #2258

Comments

@e40pud
Copy link
Contributor

e40pud commented Jul 13, 2022

Issue: elastic/kibana#112315
PR: elastic/kibana#135116

Background

Currently, when a timestamp override field is defined for detection engine rules, @timestamp is always added automatically as a fallback timestamp field. This is useful in cases where multiple data sources are being queried by the same rule, but not all data sources populate the timestamp override field. However, in other cases @timestamp may be completely unreliable and we would like to avoid querying it at all. We should make the @timestamp fallback behavior more configurable, perhaps allowing multiple timestamp overrides to be defined or creating a flag that disables the fallback.

These changes allow user to configure @timestamp fallback when timestamp override is defined. There is a new checkbox which allows to disable fallback to @timestamp when Timestamp Override is defined.
image

For the 8.4 release, we need to update documentation for the security rule creation. We added a new optional configuration parameter timestamp_override_fallback_disabled in this PR as part of these ticket. The new parameter needs to be added along the timestamp_override which is listed here in the UI docs and here in the create API docs, and also the other APIs (update etc).

We also noticed that timestamp_override is listed in the wrong section there, it should be listed as optional for all rule types, not just EQL, query, and threshold. We should add the timestamp override fallback param in the same places timestamp override appears.

cc @joepeeples

@e40pud e40pud added the v8.4.0 label Jul 13, 2022
@joepeeples joepeeples self-assigned this Jul 13, 2022
@jmikell821 jmikell821 changed the title [DOCS][8.4] Create documentation for the new configuration parameter in Create Rule flow [DOCS][8.4] Fallback to @timestamp is configurable when timestamp override is defined Aug 4, 2022
@joepeeples joepeeples assigned jmikell821 and unassigned joepeeples Aug 5, 2022
@joepeeples
Copy link
Contributor

Reassigning to @jmikell821 since she's documenting rule creation for 8.4 in #2258.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants