Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Doc level monitor dryrun results in [alerting_exception] routing is required for [.opendistro-alerting-alerts] error. #1295

Open
AWSHurneyt opened this issue Nov 2, 2023 · 1 comment
Labels
bug Something isn't working

Comments

@AWSHurneyt
Copy link
Collaborator

What is the bug?
The alerting frontend allows users to send a test message to the notification channel configured for an action. The test message button is not working in alerting v2.7 and up. We will need to verify older versions as well; I would recommend we start checking in v2.3 as that's the version just before changes were implemented to the alerting plugin to support Security Analytics in v2.4.

This seems to relate to the _routing mapping in the alert_mapping.json. Because the monitor doesn't exist, there may be an issue associating it with any findings/alerts generated during the dry run. Creating the monitor, and pressing the Send test message button on the edit page results in the same error, though.

After creating the monitor notifications are sent as expected during the regular monitor executions.

How can one reproduce the bug?
Steps to reproduce the behavior:

  1. Create a notification channel
  2. Go to the create monitor page
  3. Select the Per document monitor option
  4. Configure a query for an index that will result in findings; I've added an example in the Additional context section below
  5. Configure a trigger using the query you've defined
  6. Add an action for that trigger that uses the channel created in step one
  7. Press the Send test message button
  8. A toast popup will appear with the following error message. In addition, if the query you configured does not result in a finding, a toast will popup claiming that the notification was sent to the channel; but a notification isn't actually sent.
Failed to send the test message

[alerting_exception] routing is required for [.opendistro-alerting-alerts]/[error-alert--97ece9d9-6e43-4bd4-874f-2ea9ed05b7bc]

What is the expected behavior?
A test notification should be sent to the selected channel with a preview of the message content.

What is your host/environment?

  • OS: macOS 13.4.1 (22F82)
  • Version: v2.7 and up (possible older versions)
  • Plugins: Alerting, and alerting dashboards

Do you have any additional context?
This is an example command that can be used to create an index and documents for testing the monitor.

POST test-index1/_doc
{
  "message": "This is an error from IAD region",
  "date": "2020-06-04T18:57:12",
  "region": "us-west-2",
  "numberField": 100
}

This is an example monitor JSON payload that's configured to generate findings when using the sample document above.

{
  "name": "doc-monitor-test",
  "type": "monitor",
  "monitor_type": "doc_level_monitor",
  "enabled": true,
  "schedule": {
    "period": {
      "unit": "MINUTES",
      "interval": 1
    }
  },
  "inputs": [
    {
      "doc_level_input": {
        "description": "",
        "indices": [
          "test-index1"
        ],
        "queries": [
          {
            "name": "Query1",
            "query": "NOT (region:\"South Pole\")",
            "tags": []
          }
        ]
      }
    }
  ],
  "triggers": [
    {
      "document_level_trigger": {
        "name": "trigger-name",
        "severity": "1",
        "condition": {
          "script": {
            "source": "query[name=Query1]",
            "lang": "painless"
          }
        },
        "actions": []
      }
    }
  ]
}
@AWSHurneyt AWSHurneyt added bug Something isn't working untriaged labels Nov 2, 2023
@AWSHurneyt
Copy link
Collaborator Author

Potentially related issue opensearch-project/alerting-dashboards-plugin#538

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants