Skip to content

Commit 9297e10

Browse files
mergify[bot]nastasha-solomongithub-actions[bot]
authored
[8.x] [Serverless][8.16] Logs request during preview rule execution (backport #5871) (#5938)
* [Serverless][8.16] Logs request during preview rule execution (#5871) * First draft * Serverless first draft * Update docs/detections/rules-ui-create.asciidoc * Fixing typos * Update docs/detections/rules-ui-create.asciidoc * Update docs/detections/rules-ui-create.asciidoc * Vitalii's input * Updated anchor text * Updated title * Minor changes * Removed extra the * Fix conflict * Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Vitalii Dmyterko <[email protected]> * Update docs/detections/rules-ui-create.asciidoc * Vitalii's feedback round 2 * var fixes * Active voice * Update docs/detections/rules-ui-create.asciidoc Co-authored-by: Joe Peeples <[email protected]> * Update docs/serverless/rules/rules-ui-create.mdx Co-authored-by: Joe Peeples <[email protected]> * Update docs/detections/rules-ui-create.asciidoc * Update docs/serverless/rules/rules-ui-create.mdx * Update docs/serverless/rules/rules-ui-create.mdx * Update slug * slugslugslug --------- Co-authored-by: Vitalii Dmyterko <[email protected]> Co-authored-by: Joe Peeples <[email protected]> (cherry picked from commit 61b4a66) # Conflicts: # docs/serverless/rules/rules-ui-create.mdx * Delete docs/serverless directory and its contents --------- Co-authored-by: Nastasha Solomon <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent 558827c commit 9297e10

File tree

1 file changed

+18
-0
lines changed

1 file changed

+18
-0
lines changed

docs/detections/rules-ui-create.asciidoc

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -820,3 +820,21 @@ TIP: Avoid setting long time ranges with short rule intervals, or the rule previ
820820

821821
* To close the preview, click the *Rule preview* button again.
822822

823+
[discrete]
824+
[[view-rule-es-queries]]
825+
==== View your rule's {es} queries (optional)
826+
827+
NOTE: This option is only offered for {esql} and event correlation rules.
828+
829+
When previewing a rule, you can also learn about its {es} queries, which are submitted when the rule runs. This information can help you identify and troubleshoot potential rule issues. You can also use it to confirm that your rule is retrieving the expected data.
830+
831+
To learn more about your rule's {es} queries, preview its results and do the following:
832+
833+
. Select the **Show {es} requests, ran during rule executions** option below the preview's date and time picker. The **Preview logged results** section displays under the histogram and alerts table.
834+
. Click the **Preview logged results** section to expand it. Within the section, each rule execution is shown on an individual row.
835+
. Expand each row to learn more about the {es} queries that the rule submits each time it executes. The following details are provided:
836+
** When the rule execution started, and how long it took to complete
837+
** A brief explanation of what the {es} queries do
838+
** The actual {es} queries that the rule submits to indices containing events that are used during the rule execution
839+
+
840+
TIP: Run the queries in {kibana-ref}/console-kibana.html[Console] to determine if your rule is retrieving the expected data. For example, to test your rule’s exceptions, run the rule’s {es} queries, which will also contain exceptions added to the rule. If your rule’s exceptions are working as intended, the query will not return events that should be ignored.

0 commit comments

Comments
 (0)