[RCA] Start investigation from alert details page #190307

benakansara · 2024-08-12T10:25:32Z

Resolves #190320 and #190396

Start investigation from Custom threshold alert details page
Go to ongoing investigation instead of creating new one if one already exists
Initial investigation status is set as ongoing
Investigation origin is set as alert

"Start investigation" is hidden for other alert types and when investigate plugin is disabled.

Testing

Add the following in kibana.dev.yml

xpack.investigate.enabled: true
xpack.investigateApp.enabled: true

Create Custom threshold rule
Open Custom threshold alert details page
Click on "Start investigation"
Verify that a new saved object is created for the investigation

Screen.Recording.2024-08-12.at.12.24.02.mov

obltmachine · 2024-08-12T10:25:47Z

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

/oblt-deploy : Deploy a Kibana instance using the Observability test environments.
run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

elasticmachine · 2024-08-12T10:30:55Z

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

…fix'

kdelemme

just some comments about the cache keys.

x-pack/plugins/observability_solution/investigate_app/public/hooks/query_key_factory.ts

x-pack/plugins/observability_solution/investigate_app/server/services/create_investigation.ts

benakansara · 2024-08-13T09:58:11Z

/ci

benakansara · 2024-08-13T10:07:31Z

/ci

kdelemme

Just did a quick review before the meeting, will continue after. Looking good so far

...solution/investigate_app/server/routes/get_global_investigate_app_server_route_repository.ts

…fix'

TinaHeiligers

Changes to kibana.jsoncLGTM

kdelemme

I left some comments, thanks for the initial refactoring of the search API.
A few things that we can tackle in another PR: duplication of hooks

x-pack/plugins/observability_solution/investigate/common/schema/create.ts

x-pack/plugins/observability_solution/investigate/common/schema/find.ts

x-pack/plugins/observability_solution/investigate/common/schema/investigation.ts

x-pack/plugins/observability_solution/investigate_app/public/hooks/use_get_alert_details.tsx

...lugins/observability_solution/investigate_app/public/hooks/use_get_investigation_details.tsx

x-pack/plugins/observability_solution/investigate_app/server/models/investigation.ts

kdelemme · 2024-08-13T17:27:31Z

...s/observability_solution/investigate_app/public/pages/details/investigation_details_page.tsx

+  const alertId = investigationDetails?.origin.id ?? '';
+
+  const {
+    data: alertDetails,
+    isLoading: isFetchAlertLoading,
+    isError: isFetchAlertError,
+  } = useFetchAlert({ id: alertId });


More of a philosophical question, but do you think the get investigation API should query RAC and include the alert details directly in its response?
So instead of doing two request sequentially, the client would just do one and get everything?
That's maybe a bit of a premature optimization. But something to think about.

that's a good question, something I was thinking about it too while implementing. We would need to have rac in context to use alerts client. I will look into it.

...ability_solution/observability/public/pages/alert_details/hooks/use_create_investigation.tsx

kdelemme · 2024-08-13T17:39:37Z

...bservability_solution/observability/public/pages/alert_details/components/header_actions.tsx

  return (
    <>
      <EuiFlexGroup direction="row" gutterSize="s" justifyContent="flexEnd">
+        {investigate &&


Is investigate null when the feature flag is off?

it's undefined

kdelemme · 2024-08-13T17:39:42Z

...bservability_solution/observability/public/pages/alert_details/components/header_actions.tsx

  } = useKibana().services;

  const { rule, refetch } = useFetchRule({
    ruleId: alert?.fields[ALERT_RULE_UUID] || '',
  });

+  const { data: investigations } = useFetchInvestigationsByAlert({


I think we should not even try to fetch the investigations in case the investigate feature flag is not enabled

Good catch. Addressed in 5a24c0b

…a/find.ts Co-authored-by: Kevin Delemme <kdelemme@gmail.com>

kibana-ci · 2024-08-13T21:16:54Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 7e0abe4
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-190307-7e0abe45c945

Failed CI Steps

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`investigate`	21	26	+5
`investigateApp`	512	552	+40
`observability`	1070	1072	+2
total			+47

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`investigate`	112	119	+7
`observability`	694	695	+1
total			+8

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`investigateApp`	431.4KB	439.5KB	+8.0KB
`observability`	424.7KB	426.8KB	+2.1KB
total			+10.2KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`investigate`	9.2KB	9.9KB	+700.0B
`observability`	101.9KB	102.0KB	+48.0B
total			+748.0B

Unknown metric groups

API count

id	before	after	diff
`investigate`	112	119	+7
`observability`	701	702	+1
total			+8

History

💔 Build #227455 failed 8a8a177
💛 Build #227444 was flaky 34f9331
💚 Build #227430 succeeded 1544474
💔 Build #227341 failed 4b6a680
💔 Build #227295 failed adf4f93

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @benakansara

kdelemme

LGTM ! Thanks for the changes, I think we'll have to move things around to avoid too much duplication at some point. But for now, it's fine.

kdelemme · 2024-08-14T13:22:08Z

...olution/observability/public/pages/alert_details/hooks/use_fetch_investigations_by_alert.tsx

+        title: 'Something went wrong while fetching Investigations',
+      });
+    },
+    enabled: Boolean(investigatePlugin),


👍🏻 nice

benakansara added 4 commits August 12, 2024 11:17

create new investigation, save, reload

2711784

remove comment

947e5d3

chnage origin type

f1c7e9e

only show investigation for custom threshold alert

315932e

benakansara self-assigned this Aug 12, 2024

benakansara added release_note:skip Skip the PR/issue when compiling release notes Team:obs-ux-management Observability Management User Experience Team v8.16.0 labels Aug 12, 2024

Merge branch 'main' into feat/start-and-save-investigation

cf5ef17

benakansara marked this pull request as ready for review August 12, 2024 10:30

benakansara requested review from a team as code owners August 12, 2024 10:30

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

977ebac

…fix'

botelastic bot added the ci:project-deploy-observability Create an Observability project label Aug 12, 2024

kdelemme reviewed Aug 12, 2024

View reviewed changes

x-pack/plugins/observability_solution/investigate_app/public/hooks/query_key_factory.ts Outdated Show resolved Hide resolved

x-pack/plugins/observability_solution/investigate_app/server/services/create_investigation.ts Outdated Show resolved Hide resolved

benakansara marked this pull request as draft August 12, 2024 14:04

benakansara added 4 commits August 13, 2024 11:13

get investigation ids from saved object

6fb3bf6

check alertid not null

b541f88

filter investigations by status

a030afe

revert aad changes

2dad0ce

benakansara removed request for a team August 13, 2024 09:18

benakansara added 3 commits August 13, 2024 11:23

pr feedback

2b21a55

Merge branch 'main' into feat/start-and-save-investigation

b811d1b

resolve merge conflicts

1233457

benakansara and others added 2 commits August 13, 2024 12:07

update query keys

8cef8a4

Merge branch 'main' into feat/start-and-save-investigation

1575b45

rename

adf4f93

benakansara marked this pull request as ready for review August 13, 2024 10:14

benakansara linked an issue Aug 13, 2024 that may be closed by this pull request

[RCA] Allow lookup for ongoing investigations related to an alert #190396

Closed

kdelemme reviewed Aug 13, 2024

View reviewed changes

...solution/investigate_app/server/routes/get_global_investigate_app_server_route_repository.ts Outdated Show resolved Hide resolved

benakansara and others added 5 commits August 13, 2024 14:18

fix tests

5ede1af

removing ref to investigate to solve circular dependency

530de3e

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

4b6a680

…fix'

resolve cyclic dep

1544474

extend search api

34f9331

TinaHeiligers approved these changes Aug 13, 2024

View reviewed changes

kdelemme reviewed Aug 13, 2024

View reviewed changes

benakansara and others added 2 commits August 13, 2024 20:01

Update x-pack/plugins/observability_solution/investigate/common/schem…

8a8a177

…a/find.ts Co-authored-by: Kevin Delemme <kdelemme@gmail.com>

pr feedback

5a24c0b

benakansara requested a review from kdelemme August 13, 2024 20:20

Merge branch 'main' into feat/start-and-save-investigation

7e0abe4

kdelemme approved these changes Aug 14, 2024

View reviewed changes

benakansara merged commit 95736fb into elastic:main Aug 14, 2024
23 checks passed

kibanamachine added the backport:skip This commit does not require backporting label Aug 14, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[RCA] Start investigation from alert details page #190307

[RCA] Start investigation from alert details page #190307

benakansara commented Aug 12, 2024 •

edited

Loading

obltmachine commented Aug 12, 2024

elasticmachine commented Aug 12, 2024

kdelemme left a comment

benakansara commented Aug 13, 2024

benakansara commented Aug 13, 2024

kdelemme left a comment

TinaHeiligers left a comment

kdelemme left a comment

kdelemme Aug 13, 2024

benakansara Aug 13, 2024

kdelemme Aug 13, 2024

benakansara Aug 13, 2024

kdelemme Aug 13, 2024

benakansara Aug 13, 2024 •

edited

Loading

kibana-ci commented Aug 13, 2024 •

edited

Loading

API count

kdelemme left a comment

kdelemme Aug 14, 2024

[RCA] Start investigation from alert details page #190307

[RCA] Start investigation from alert details page #190307

Conversation

benakansara commented Aug 12, 2024 • edited Loading

Testing

obltmachine commented Aug 12, 2024

🤖 GitHub comments

elasticmachine commented Aug 12, 2024

kdelemme left a comment

Choose a reason for hiding this comment

benakansara commented Aug 13, 2024

benakansara commented Aug 13, 2024

kdelemme left a comment

Choose a reason for hiding this comment

TinaHeiligers left a comment

Choose a reason for hiding this comment

kdelemme left a comment

Choose a reason for hiding this comment

kdelemme Aug 13, 2024

Choose a reason for hiding this comment

benakansara Aug 13, 2024

Choose a reason for hiding this comment

kdelemme Aug 13, 2024

Choose a reason for hiding this comment

benakansara Aug 13, 2024

Choose a reason for hiding this comment

kdelemme Aug 13, 2024

Choose a reason for hiding this comment

benakansara Aug 13, 2024 • edited Loading

Choose a reason for hiding this comment

kibana-ci commented Aug 13, 2024 • edited Loading

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Page load bundle

API count

History

kdelemme left a comment

Choose a reason for hiding this comment

kdelemme Aug 14, 2024

Choose a reason for hiding this comment

benakansara commented Aug 12, 2024 •

edited

Loading

benakansara Aug 13, 2024 •

edited

Loading

kibana-ci commented Aug 13, 2024 •

edited

Loading