Skip to content
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
bbeced0
First draft
nastasha-solomon Sep 30, 2024
390b265
Serverless first draft
nastasha-solomon Sep 30, 2024
24e750f
Update docs/detections/rules-ui-create.asciidoc
nastasha-solomon Sep 30, 2024
2e6f291
Fixing typos
nastasha-solomon Oct 1, 2024
b9183d4
Update docs/detections/rules-ui-create.asciidoc
nastasha-solomon Oct 1, 2024
de269cc
Update docs/detections/rules-ui-create.asciidoc
nastasha-solomon Oct 1, 2024
d9b849c
Vitalii's input
nastasha-solomon Oct 1, 2024
3172a1e
Updated anchor text
nastasha-solomon Oct 1, 2024
1194e07
Updated title
nastasha-solomon Oct 1, 2024
fc2390a
Minor changes
nastasha-solomon Oct 1, 2024
56ef20a
Removed extra the
nastasha-solomon Oct 1, 2024
6c7d87c
Fix conflict
nastasha-solomon Oct 1, 2024
2967d20
Update docs/detections/rules-ui-create.asciidoc
nastasha-solomon Oct 1, 2024
bd98d1e
Update docs/detections/rules-ui-create.asciidoc
nastasha-solomon Oct 1, 2024
d985ca3
Vitalii's feedback round 2
nastasha-solomon Oct 1, 2024
fdc7dd0
var fixes
nastasha-solomon Oct 1, 2024
ef045cd
Active voice
nastasha-solomon Oct 1, 2024
2be3231
Update docs/detections/rules-ui-create.asciidoc
nastasha-solomon Oct 2, 2024
d2b73bd
Update docs/serverless/rules/rules-ui-create.mdx
nastasha-solomon Oct 2, 2024
ffb767f
Update docs/detections/rules-ui-create.asciidoc
nastasha-solomon Oct 2, 2024
45e2aef
Update docs/serverless/rules/rules-ui-create.mdx
nastasha-solomon Oct 2, 2024
087731c
Update docs/serverless/rules/rules-ui-create.mdx
nastasha-solomon Oct 2, 2024
8883ee5
Update slug
nastasha-solomon Oct 2, 2024
bfca164
slugslugslug
nastasha-solomon Oct 3, 2024
fb32e07
Merge branch 'main' into issue-5844-logged-es-request-rule-preview
nastasha-solomon Oct 3, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions docs/detections/rules-ui-create.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -820,3 +820,20 @@ TIP: Avoid setting long time ranges with short rule intervals, or the rule previ

* To close the preview, click the *Rule preview* button again.

[discrete]
[[debug-rule-queries]]
==== Debug rule queries (optional)

NOTE: This option is only offered for {esql} rules.

When previewing an {esql} rule, you can also learn more about the {es} queries that are submitted when the rule runs. This information can be helpful for identifying and troubleshooting potential rule issues, or validating that your rule is retrieving the expected data.

To learn more your rule's {es} queries, preview its results and do the following:

. Beneath the rule preview's date and time picker, find the **Show Elasticsearch requests, ran during rule executions** option and select it. The **Preview logged results** section displays under the the histogram and alerts table in the panel.
. Expand the **Preview logged results** section to display subsections with more information about the rule's {es} queries. The following details are provided:
** The expected start date and time of each rule execution and how long it took to complete
** A brief explanation of the {es} queries
** The actual {es} queries that the rule submits when it runs
+
TIP: Copy the queries and run them in Dev Tools (**{kib}** -> **Management** -> **Dev Tools**) to determine if your rule is retrieving the expected data.
21 changes: 21 additions & 0 deletions docs/serverless/rules/rules-ui-create.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -875,3 +875,24 @@ To interact with the rule preview:

* To close the preview, click the **Rule preview** button again.

<div id="debug-rule-queries"></div>

### Debug rule queries (optional)

<DocCallOut title="Note">
This option is only offered for ((esql)) rules.
</DocCallOut>

When previewing an ((esql)) rule, you can also learn more about the ((es)) queries that are submitted when the rule runs. This information can be helpful for identifying and troubleshooting potential rule issues, or validating that your rule is retrieving the expected data.

To learn more your rule's ((es)) queries, preview its results and do the following:

1. Beneath the rule preview's date and time picker, find the **Show Elasticsearch requests, ran during rule executions** option and select it. The **Preview logged results** section displays under the the histogram and alerts table in the panel.
1. Expand the **Preview logged results** section to display subsections with more information about the rule's ((es)) queries. The following details are provided:
* The expected start date and time of each rule execution and how long it took to complete
* A brief explanation of the ((es)) queries
* The actual ((es)) queries that the rule submits when it runs

<DocCallOut title="Tip">
Copy the queries and run them in Console (**Developer tools** -> **Console**) to determine if your rule is retrieving the expected data.
</DocCallOut>