Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Alerting][Docs] Changed alerting documentation to point to a single source of explaining the configurations. #92942

Merged
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions docs/settings/alert-action-settings.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,9 @@ You can configure the following settings in the `kibana.yml` file.
[cols="2*<"]
|===

| `xpack.actions.enabled` {ess-icon}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is in the cloud allowlist. I don't see it in here: https://github.com/elastic/cloud/blob/master/scala-services/adminconsole/src/main/resources/settings/kibana/alerting.yml

Should we add it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure about this config option at all :-) @mikecote what do you think?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have a feeling #90934 will go through for 8.0, which would reverse this work. I'm +1 to not allow-list it until someone asks, and when they do, we can gather their use case as to why.

| Feature toggle that enables Actions in {kib}. It defaults to `true`.
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved

| `xpack.actions.allowedHosts` {ess-icon}
| A list of hostnames that {kib} is allowed to connect to when built-in actions are triggered. It defaults to `[*]`, allowing any host, but keep in mind the potential for SSRF attacks when hosts are not explicitly added to the allowed hosts. An empty list `[]` can be used to block built-in actions from making any external connections. +
+
Expand All @@ -51,6 +54,23 @@ You can configure the following settings in the `kibana.yml` file.
+
Disabled action types will not appear as an option when creating new connectors, but existing connectors and actions of that type will remain in {kib} and will not function.

| `xpack.actions.preconfigured`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this have {ess-icon}?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, we are not supporting this in Cloud

| Specifies preconfigured action IDs and configs. It defaults to {}.
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved

| `xpack.actions.proxyUrl` {ess-icon}
| Specifies the proxy URL to use, if using a proxy for actions. By default is no proxy used.
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved

| `xpack.actions.proxyHeader` {ess-icon}
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved
| Specifies HTTP headers for proxy, if using a proxy for actions.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the default?

YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved

| `xpack.actions.proxyRejectUnauthorizedCertificates` {ess-icon}
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved
| Set to `false` to bypass certificate validation for proxy, if using a proxy for actions. It defaults to `true`.
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved

| `xpack.actions.rejectUnauthorized` {ess-icon}
| Set to `false` to bypass certificate validation for actions. It defaults to `true`. +
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved
+
As an alternative to both `xpack.actions.proxyRejectUnauthorizedCertificates` and `xpack.actions.rejectUnauthorized`, the OS level environment variable `NODE_EXTRA_CA_CERTS` can be set to point to a file that contains the root CA(s) needed for certificates to be trusted.
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved

|===

[float]
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ This example shows a preconfigured action type with one out-of-the box connector
name: 'Server log #xyz'
```

<1> `enabledActionTypes` excludes the preconfigured action type to prevent creating and deleting connectors.
<1> `enabledActionTypes` excludes the preconfigured action type to prevent creating and deleting connectors. For more details check <<action-settings, alerting and action settings>>.
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved
<2> `preconfigured` is the setting for defining the list of available connectors for the preconfigured action type.

[[managing-pre-configured-action-types]]
Expand Down
2 changes: 1 addition & 1 deletion docs/user/alerting/alerting-getting-started.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,7 @@ Pre-packaged *alert types* simplify setup, hide the details complex domain-speci

If you are using an *on-premises* Elastic Stack deployment:

* In the kibana.yml configuration file, add the <<alert-action-settings-kb,`xpack.encryptedSavedObjects.encryptionKey`>> setting.
* In the kibana.yml configuration file, add the <<action-settings,`xpack.encryptedSavedObjects.encryptionKey`>> setting.
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved
* For emails to have a footer with a link back to {kib}, set the <<server-publicBaseUrl, `server.publicBaseUrl`>> configuration setting.

If you are using an *on-premises* Elastic Stack deployment with <<using-kibana-with-security, *security*>>:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,15 @@

{kib} alerting run both alert checks and actions as persistent background tasks managed by the Kibana Task Manager. This has two major benefits:
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved

* *Persistence*: all task state and scheduling is stored in {es}, so if {kib} is restarted, alerts and actions will pick up where they left off. Task definitions for alerts and actions are stored in the index specified by `xpack.task_manager.index` (defaults to `.kibana_task_manager`). It is important to have at least 1 replica of this index for production deployments, since if you lose this index all scheduled alerts and actions are also lost.
* *Persistence*: all task state and scheduling is stored in {es}, so if {kib} is restarted, alerts and actions will pick up where they left off. Task definitions for alerts and actions are stored in the index specified by <<task-manager-settings, `xpack.task_manager.index`>> (defaults to `.kibana_task_manager`). It is important to have at least 1 replica of this index for production deployments, since if you lose this index all scheduled alerts and actions are also lost.
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved
* *Scaling*: multiple {kib} instances can read from and update the same task queue in {es}, allowing the alerting and action load to be distributed across instances. In cases where a {kib} instance no longer has capacity to run alert checks or actions, capacity can be increased by adding additional {kib} instances.

[float]
=== Running background alert checks and actions

{kib} background tasks are managed by:

* Polling an {es} task index for overdue tasks at 3 second intervals. This interval can be changed using the `xpack.task_manager.poll_interval` setting.
* Polling an {es} task index for overdue tasks at 3 second intervals. This interval can be changed using the <<task-manager-settings, `xpack.task_manager.poll_interval`>> setting.
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved
* Tasks are then claiming them by updating them in the {es} index, using optimistic concurrency control to prevent conflicts. Each {kib} instance can run a maximum of 10 concurrent tasks, so a maximum of 10 tasks are claimed each interval.
* Tasks are run on the {kib} server.
* In the case of alerts which are recurring background checks, upon completion the task is scheduled again according to the <<defining-alerts-general-details, check interval>>.
Expand Down
22 changes: 1 addition & 21 deletions docs/user/alerting/defining-alerts.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -101,29 +101,9 @@ image::images/alert-flyout-add-action.png[You can add multiple actions on an ale

[NOTE]
==============================================
Actions are not required on alerts. In some cases you may want to run an alert without actions first to understand its behavior, and configure actions later.
Actions are not required on alerts. In some cases you may want to run an alert without actions first to understand its behavior, and <<action-settings, configure actions>> later.
YulNaumenko marked this conversation as resolved.
Show resolved Hide resolved
==============================================

[float]
[[actions-configuration]]
=== Global actions configuration
Some actions configuration options apply to all actions.
If you are using an *on-prem* Elastic Stack deployment, you can set these in the kibana.yml file.
If you are using a cloud deployment, you can set these via the console.

Here's a list of the available global configuration options and an explanation of what each one does:

* `xpack.actions.enabled`: Feature toggle that enables Actions in {kib}. Default: `true`
* `xpack.actions.allowedHosts`: Specifies an array of host names which actions such as email, Slack, PagerDuty, and webhook can connect to. An element of * indicates any host can be connected to. An empty array indicates no hosts can be connected to. Default: [ {asterisk} ]
* `xpack.actions.enabledActionTypes`: Specifies an array of action types that are enabled. An {asterisk} indicates all action types registered are enabled. The action types that {kib} provides are `.email`, `.index`, `.jira`, `.pagerduty`, `.resilient`, `.server-log`, `.servicenow`, `.servicenow-sir`, `.slack`, `.teams`, and `.webhook`. Default: [ {asterisk} ]
* `xpack.actions.preconfigured`: Specifies preconfigured action IDs and configs. Default: {}
* `xpack.actions.proxyUrl`: Specifies the proxy URL to use, if using a proxy for actions.
* `xpack.actions.proxyHeader`: Specifies HTTP headers for proxy, if using a proxy for actions.
* `xpack.actions.proxyRejectUnauthorizedCertificates`: Set to `false` to bypass certificate validation for proxy, if using a proxy for actions.
* `xpack.actions.rejectUnauthorized`: Set to `false` to bypass certificate validation for actions.

*NOTE:* As an alternative to both `xpack.actions.proxyRejectUnauthorizedCertificates` and `xpack.actions.rejectUnauthorized`, the OS level environment variable `NODE_EXTRA_CA_CERTS` can be set to point to a file that contains the root CA(s) needed for certificates to be trusted.

[float]
=== Managing alerts

Expand Down
2 changes: 1 addition & 1 deletion x-pack/plugins/triggers_actions_ui/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -1149,7 +1149,7 @@ triggersActionsUi.actionTypeRegistry.register(getSomeNewActionType());

## Create and register new action type UI

Before starting the UI implementation, the [server side registration](https://github.com/elastic/kibana/tree/master/x-pack/plugins/actions#kibana-actions-configuration) should be done first.
Before starting the UI implementation, the [server side registration](https://github.com/elastic/kibana/tree/master/x-pack/plugins/actions#action-types) should be done first.

Action type UI is expected to be defined as `ActionTypeModel` object.

Expand Down