@@ -98,7 +98,10 @@ function normalizeConditionParameters(rule) {
9898}
9999
100100function normalizeNotificationParameters ( notification_parameters ) {
101- const { split_fields, severity, ...result } = notification_parameters ;
101+ const { split_fields, severity, aggregation_time, ...result } = notification_parameters ;
102+ if ( result . log_body ) {
103+ result . log_body = result . log_body . replace ( '{logging_alert.id}' , '{event.fields.aggregation_id}' ) ;
104+ }
102105 return result ;
103106}
104107
@@ -140,14 +143,24 @@ function normalizeConditionType(rule) {
140143 return rule . condition_type ;
141144}
142145
146+ function normalizeAggregationTime ( rule ) {
147+ const aggregation_time = rule . aggregation_time ;
148+ if ( aggregation_time === null || aggregation_time === undefined ) {
149+ return rule . notification_parameters . aggregation_time ;
150+ }
151+ return aggregation_time ;
152+ }
153+
143154function normalizeImportedRule ( rule ) {
144155 const condition_parameters = normalizeConditionParameters ( rule ) ;
145156 const notification_parameters = normalizeNotificationParameters ( rule . notification_parameters ) ;
146157 const condition_type = normalizeConditionType ( rule ) ;
147158 const priority = normalizePriority ( rule ) ;
148159 const description = normalizeDescription ( rule . description ) ;
160+ const aggregation_time = normalizeAggregationTime ( rule ) ;
161+
149162 return {
150- priority, description, condition_type, condition_parameters, notification_parameters,
163+ priority, description, condition_type, condition_parameters, notification_parameters, aggregation_time : aggregation_time ,
151164 title : rule . title , stream : rule . stream , second_stream : rule . second_stream , disabled : rule . disabled
152165 } ;
153166}
0 commit comments