add `defaultActionMessage` to index threshold alert UI type definition

[pmuellr]

It was recently noted that the index threshold alertType does not provide a defaultActionMessage - but it seems like it should. That would go in the object returned here:

kibana/x-pack/plugins/triggers_actions_ui/public/application/components/builtin_alert_types/threshold/index.ts

Lines 13 to 22 in 6d819b7

	export function getAlertType(): AlertTypeModel<IndexThresholdAlertParams, AlertsContextValue> {
	return {
	id: '.index-threshold',
	name: 'Index threshold',
	iconClass: 'alert',
	alertParamsExpression: lazy(() => import('./expression')),
	validate: validateExpression,
	requiresAppContext: false,
	};
	}

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[dB2510]

@pmuellr @mikecote I am new to elastic/kibana. Can I take up this issue?

[pmuellr]

@dB2510 sure!

Here's what I was thinking. The index threshold alert creates a context variable named message, here:

kibana/x-pack/plugins/alerting_builtins/server/alert_types/index_threshold/action_context.ts

Lines 52 to 66 in ae8f8e1

	const message = i18n.translate(
	'xpack.alertingBuiltins.indexThreshold.alertTypeContextMessageDescription',
	{
	defaultMessage:
	'alert {name} group {group} value {value} exceeded threshold {function} over {window} on {date}',
	values: {
	name: alertInfo.name,
	group: baseContext.group,
	value: baseContext.value,
	function: humanFn,
	window,
	date: baseContext.date,
	},
	}
	);

Specifically,

alert {name} group {group} value {value} exceeded threshold {function} over {window} on {date}'

The defaultActionMessage property mentioned at the top should, at a minimum, match that. It will be a mustache template using the existing context variables.

My first take would be setting it to this string:

alert {{alertName}} group {{context.group}} value {{context.value}} exceeded threshold {{context.function}} over {{context.window}} on {{context.date}}'

I believe that would be a direct replacement, and would be good enough to ship with.

We should make sure there is a functional test somewhere that will end up using this as the message, so we can validate that it's rendering as we expect. I'm guessing we don't have one now, but will poke around a bit to look for one, or a place to add a new one, more when you get to that point.

If you've not contributed to Kibana before, there's some guidelines here: https://www.elastic.co/guide/en/kibana/master/contributing.html - per that page, it's unlikely we'll need a release note for this change.

[dB2510]

@pmuellr I am moving forward with the information you have provided. Can you please guide me on how can I reproduce this issue?

[pmuellr]

The repro would be:

• create an index threshold alert
• add an action - the server log action is fine
• the "message" field for the server log action will be blank

Once we implement the defaultActionMessage property on the index threshold alert, the same scenario would have the "message" field of the action parameter filled in with the mustache template (eg, alert {{alertName}} group {{context.group}} ...)

[dB2510]

@pmuellr For creating an alert, do we require TLS between elasticsearch and kibana compulsorily?

[pmuellr]

TLS between elasticsearch and kibana is compulsorily IF security is enabled. You can run without security enabled (ES + Kibana).

At development time, the easiest way to launch ES and Kibana with security is via the following commands, run in separate terminal windows:

yarn es snapshot --ssl --license trial   # start elasticsearch
yarn start --ssl                         # start Kibana

Also for development time, you should run yarn kbn bootstrap before the two other commands, to get all the core plugins built correctly. The VS Code typescript support will also work correctly after running the bootstrap command (you should restart VS Code after it completes). After running the bootstrap once, you'll only need to run it again after checking out a different git branch, and get everything initialized for that branch.

[dB2510]

@pmuellr It worked. You said that message field of server log action should be empty but when I tried that it was saying that message is required. Then I added a 2 word message and saved the alert but was unable to observe that message whenever that alert is running in instances section of that alert.
These were settings that I did when creating an alert

Select an index
INDEX .kibana-event-log-8.0.0
WHEN count()
OVER all documents

Define the condition
IS ABOVE 10
FOR THE LAST 1 minute

And created a server log connector with level info.

[dB2510]

@pmuellr Is this issue has been resolved by this #78930 pull request?

[pmuellr]

@dB2510: Is this issue has been resolved by this #78930 pull request?

No, the prefix of [APM] is a clue - the APM solution team provides several different alert types, and has been adding the defaultActionMessage to their own alerts. Since they don't "own" the index threshold alert, they didn't change it.

This PR only needs to cover the index threshold alert, which is the only alert provided by the alerting team.