Description
openedon Apr 9, 2024
Describe the issue:
Currently when value list is not applied in exception during rule execution, rule will have warning status with a general error message that does not give any information why exception did not work.
For example, if value is list is larger than 65k, the warning message will be logged as:
No reason is why it happened. Similarly, exception value list can be not applied if ip_range list is greater than 200.
Or if any ES request to value list fails within https://github.com/elastic/kibana/blob/8.13/x-pack/plugins/lists/server/services/exception_lists/build_exception_filter.ts file utilities.
Instead, warning message should also contain a reason why exception did not apply.
Something like:
The following exceptions won't be applied to rule execution: Large value list. Value list is greater than limit 65k
Depends on an actual reason, why exception did not apply during rule run.
This enhancing messaging would greatly help us and customers in troubleshooting exception related issues.