Document 'execution_summary' response part of detection APIs (#1900)

* Document 'execution_summary' response part of detection APIs * Apply suggestions Co-authored-by: Joe Peeples <joe.peeples@elastic.co> Co-authored-by: Janeen Mikell-Straughn <57149392+jmikell821@users.noreply.github.com>
elastic · May 3, 2022 · 70e0628 · 70e0628
1 parent a67d6ca
commit 70e0628
Show file tree

Hide file tree

Showing 4 changed files with 79 additions and 12 deletions.
diff --git a/docs/detections/api/rules/rules-api-bulk-actions.asciidoc b/docs/detections/api/rules/rules-api-bulk-actions.asciidoc
@@ -337,12 +337,7 @@ For `enable`, `disable`, `delete`, `edit`, and `duplicate` actions, a JSON objec
                   "Elastic",
                   "Network",
                   "Threat Detection",
-                  "ML",
-                  "777",
-                  "888",
-                  "nine-nine-seven",
-                  "test",
-                  "test-2"
+                  "ML"
                ],
                "interval":"15m",
                "enabled":true,
@@ -386,7 +381,20 @@ For `enable`, `disable`, `delete`, `edit`, and `duplicate` actions, a JSON objec
                "throttle":"no_actions",
                "actions":[
 
-               ]
+               ],
+               "execution_summary": {                 <1>
+                 "last_execution": {
+                   "date": "2022-03-23T16:06:12.787Z",
+                   "status": "partial failure",
+                   "status_order": 20,
+                   "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
+                   "metrics": {
+                       "total_search_duration_ms": 135,
+                       "total_indexing_duration_ms": 15,
+                       "execution_gap_duration_s": 0,
+                   }
+                 }
+               }
             }
          ],
          "created":[
@@ -405,6 +413,8 @@ For `enable`, `disable`, `delete`, `edit`, and `duplicate` actions, a JSON objec
 }
 --------------------------------------------------
 
+<1> dev:[] `execution_summary` is under development and its schema may change.
+
 
 For an `export` action, an `.ndjson` file containing exported rules.
 
@@ -472,10 +482,7 @@ If processing of any rule fails, a partial error outputs the ID and/or name of t
                         "Windows",
                         "APM",
                         "macOS",
-                        "Linux",
-                        "777",
-                        "888",
-                        "nine-nine-seven"
+                        "Linux"
                     ],
                     "interval": "5m",
                     "enabled": true,
@@ -546,7 +553,20 @@ If processing of any rule fails, a partial error outputs the ID and/or name of t
                     ],
                     "query": "event.kind:alert and not event.module:(endgame or endpoint)\n",
                     "throttle": "no_actions",
-                    "actions": []
+                    "actions": [],
+                    "execution_summary": {                 <1>
+                    "last_execution": {
+                      "date": "2022-03-23T16:06:12.787Z",
+                      "status": "partial failure",
+                      "status_order": 20,
+                      "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
+                      "metrics": {
+                          "total_search_duration_ms": 135,
+                          "total_indexing_duration_ms": 15,
+                          "execution_gap_duration_s": 0,
+                      }
+                    }
+                  }
                 }
             ],
             "created": [],
@@ -560,3 +580,5 @@ If processing of any rule fails, a partial error outputs the ID and/or name of t
     }
 }
 --------------------------------------------------
+
+<1> dev:[] `execution_summary` is under development and its schema may change.
diff --git a/docs/detections/api/rules/rules-api-find.asciidoc b/docs/detections/api/rules/rules-api-find.asciidoc
@@ -117,10 +117,25 @@ Example response:
           ]
         }
       ],
+      "execution_summary": {                      <1>
+        "last_execution": {
+          "date": "2022-03-23T16:06:12.787Z",
+          "status": "partial failure",
+          "status_order": 20,
+          "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
+          "metrics": {
+              "total_search_duration_ms": 135,
+              "total_indexing_duration_ms": 15,
+              "execution_gap_duration_s": 0,
+          }
+        }
+      },
       "version": 1
     },
     ...
   ]
 }
 
 --------------------------------------------------
+
+<1> dev:[] `execution_summary` is under development and its schema may change.
diff --git a/docs/detections/api/rules/rules-api-get.asciidoc b/docs/detections/api/rules/rules-api-get.asciidoc
@@ -95,7 +95,22 @@ Example response:
       ]
     }
   ],
+  "execution_summary": {                      <1>
+    "last_execution": {
+      "date": "2022-03-23T16:06:12.787Z",
+      "status": "partial failure",
+      "status_order": 20,
+      "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
+      "metrics": {
+          "total_search_duration_ms": 135,
+          "total_indexing_duration_ms": 15,
+          "execution_gap_duration_s": 0,
+      }
+    }
+  },
   "version": 1
 }
 
 --------------------------------------------------
+
+<1> dev:[] `execution_summary` is under development and its schema may change.
diff --git a/docs/detections/api/rules/rules-api-update.asciidoc b/docs/detections/api/rules/rules-api-update.asciidoc
@@ -510,6 +510,21 @@ Example response:
       ]
     }
   ],
+  "execution_summary": {                      <1>
+    "last_execution": {
+      "date": "2022-03-23T16:06:12.787Z",
+      "status": "partial failure",
+      "status_order": 20,
+      "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
+      "metrics": {
+          "total_search_duration_ms": 135,
+          "total_indexing_duration_ms": 15,
+          "execution_gap_duration_s": 0,
+      }
+    }
+  },
   "version": 2
 }
 --------------------------------------------------
+
+<1> dev:[] `execution_summary` is under development and its schema may change.