Click the filter icon ( ) to create a global search filter based on the rule execution’s ID value. The Actions column allows you to show alerts generated from a given rule execution. The Show metrics columns toggle includes more or less data in the table, pertaining to the timing of each rule execution. This is separate from the global date and time picker at the top of the rule details page. The date and time picker sets the time range of rule executions included in the table. For example, a custom query rule tried to search an index pattern that couldn’t be found in Elasticsearch. Warning: Nothing prevented the rule from running, but it still might not have returned the expected results.For example, a machine learning rule whose corresponding machine learning job wasn’t running. Failed: The rule encountered an error that prevented it from running.This doesn’t necessarily mean it generated an alert, just that it ran without error. Succeeded: The rule was able to complete its defined search.To access a rule’s execution log, go to Manage → Rules, click the rule’s name to open its details, then scroll down and select the Execution results tab. This can help you troubleshoot a particular rule if it isn’t behaving as expected (for example, if it isn’t creating alerts or takes a long time to run). Execution results editĮach detection rule execution is logged, including its success or failure, any warning or error messages, and how long it took to search for data, create alerts, and complete. This also allows you to perform the same actions that are available on the Rules tab, such as modifying or deleting rules, activating or deactivating rules, exporting or importing rules, and duplicating prebuilt rules. If you experience performance issues when working with the table, you can turn this setting off.įor detailed information on a rule, the alerts it generated, and associated errors, click on its name in the table. This experimental table view allows advanced sorting capabilities. To sort by any other column, switch on the Technical preview toggle above the table.
By default, you can only sort by the Rule and Enabled columns on this tab.
0 kommentar(er)
