Patrick Mueller pmuellr

## es-log.txt
info [o.e.x.i.a.TransportPutLifecycleAction] [pmuellr.muellerware.org] adding index lifecycle policy [.kibana-event-log-policy]
info [o.e.c.m.MetaDataIndexTemplateService] [pmuellr.muellerware.org] adding template [.kibana-event-log-8.0.0-template] for index patterns [.kibana-event-log-8.0.0-*]
info [o.e.c.m.MetaDataCreateIndexService] [pmuellr.muellerware.org] [.kibana-event-log-8.0.0-000001] creating index, cause [api], templates [.kibana-event-log-8.0.0-template], shards [1]/[1], mappings [_doc]
info [o.e.x.i.IndexLifecycleTransition] [pmuellr.muellerware.org] moving index [.kibana-event-log-8.0.0-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [.kibana-event-log-policy]
info [o.e.x.i.IndexLifecycleTransition] [pmuellr.muellerware.org] moving index [.kibana-event-log-8.0.0-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [.kibana-event-log-policy]
info [o.e.x.i

## canvas-es-hb-sim
filters
| essql
  query="SELECT \"@timestamp\" as time, \"summary.up\" as up FROM \"es-hb-sim\" WHERE time > NOW() - INTERVAL 60 SECONDS"
| pointseries x="time" y="up"
| plot defaultStyle={seriesStyle lines="1" fill=1 bars="0"}
| render

## whole-lotta-alerts-hb.sh
#!/usr/bin/env bash

# creates a number of alerts with a server-log action

# Note that default alerttype - example.heartbeat is from
# https://github.com/pmuellr/kbn-sample-plugins#exampleheartbeat

# requires the following:
#   jq:         https://stedolan.github.io/jq/download/
#   kbn-action: https://github.com/pmuellr/kbn-action/blob/master/README.md

## graphic-3.html
<!DOCTYPE html>
<meta charset="utf-8">
<link rel="stylesheet" type="text/css" href="./node_modules/@observablehq/inspector/dist/inspector.css">
<body>
<script type="module">
import { Runtime, Inspector } from "./node_modules/@observablehq/runtime/dist/runtime.js";

const runtime = new Runtime()
const inspector = Inspector.into(document.body)
const mod = runtime.module(define, inspector)

## es-ilm-rollover-setup.text
DELETE _ilm/policy/event_log_policy
DELETE _template/event_log_template
DELETE event-log-000001
DELETE event-log-000002

PUT _ilm/policy/event_log_policy
{
  "policy": {
    "phases": {
      "hot": {

## kbn-fizz-buzz-alerts.sh
#!/usr/bin/env bash

source ~/.kbn-fizz-buzz-secrets.sh

ACTION_ID_SELOG=`kbn-action create .server-log "fizz-buzz server-log" "{}" "{}"                                                                                              | jq -r ".id"`
ACTION_ID_SLACK=`kbn-action create .slack      "fizz-buzz slack"      "{}"                                               "{webhookUrl: '$SLACK_WEBHOOKURL'}"                 | jq -r ".id"`
ACTION_ID_EMAIL=`kbn-action create .email      "fizz-buzz email"      "{service: '$EMAIL_SERVICE', from: '$EMAIL_FROM'}" "{user: '$EMAIL_USER' password: '$EMAIL_PASSWORD'}" | jq -r ".id"`
ACTION_ID_INDEX=`kbn-action create .index      "fizz-buzz index"      "{index: 'fizz-buzz'}"                             "{}"                                                | jq -r ".id"`
ACTION_ID_PDUTY=`kbn-action create .pagerduty  "fizz-buzz pagerduty"  "{}"                                               "{routingKey: '$PAGERDUTY_ROUTING_KEY'}"            | jq -r ".id"`

## audit_log.ts
/*
 * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
 * or more contributor license agreements. Licensed under the Elastic License;
 * you may not use this file except in compliance with the Elastic License.
 */

type IAuditRecord = Record<string, any>;

interface IAuditLog {
  initialize(): Promise<void>;

## whole-lotta-alerts.sh
#!/usr/bin/env bash

# creates a number of alerts with a server-log action

# Note that default alerttype - test.always-firing is part of the
# alerting function tests, and writes documents to the index $GARBAGE_INDEX_NAME
# specified below (it's uses it productively in tests, but not useful here).
# So, if you use this default alerttype, you should be pointing your $KBN_URLBASE to
# a Function Test Server.

## generic-kibana-rfc.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                pmuellr
                / generic-kibana-rfc.md
            
            
              Created Jul 2, 2019
            
              
                generic template for Kibana RFCs
              
          
      View generic-kibana-rfc.md
  
    
Start Date: 20yy-mm-dd
RFC PR: (leave this empty)
Kibana Issue: TBD

Summary

  
## index.ts
// path: x-pack/test/api_integration/fixtures/plugins/action_runner/index.ts

/*
 * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
 * or more contributor license agreements. Licensed under the Elastic License;
 * you may not use this file except in compliance with the Elastic License.
 */

import Joi from 'joi';
	info [o.e.x.i.a.TransportPutLifecycleAction] [pmuellr.muellerware.org] adding index lifecycle policy [.kibana-event-log-policy]
	info [o.e.c.m.MetaDataIndexTemplateService] [pmuellr.muellerware.org] adding template [.kibana-event-log-8.0.0-template] for index patterns [.kibana-event-log-8.0.0-*]
	info [o.e.c.m.MetaDataCreateIndexService] [pmuellr.muellerware.org] [.kibana-event-log-8.0.0-000001] creating index, cause [api], templates [.kibana-event-log-8.0.0-template], shards [1]/[1], mappings [_doc]
	info [o.e.x.i.IndexLifecycleTransition] [pmuellr.muellerware.org] moving index [.kibana-event-log-8.0.0-000001] from [null] to [{"phase":"new","action":"complete","name":"complete"}] in policy [.kibana-event-log-policy]
	info [o.e.x.i.IndexLifecycleTransition] [pmuellr.muellerware.org] moving index [.kibana-event-log-8.0.0-000001] from [{"phase":"new","action":"complete","name":"complete"}] to [{"phase":"hot","action":"unfollow","name":"wait-for-indexing-complete"}] in policy [.kibana-event-log-policy]
	info [o.e.x.i
	filters
	\| essql
	query="SELECT \"@timestamp\" as time, \"summary.up\" as up FROM \"es-hb-sim\" WHERE time > NOW() - INTERVAL 60 SECONDS"
	\| pointseries x="time" y="up"
	\| plot defaultStyle={seriesStyle lines="1" fill=1 bars="0"}
	\| render
	#!/usr/bin/env bash

	# creates a number of alerts with a server-log action

	# Note that default alerttype - example.heartbeat is from
	# https://github.com/pmuellr/kbn-sample-plugins#exampleheartbeat

	# requires the following:
	# jq: https://stedolan.github.io/jq/download/
	# kbn-action: https://github.com/pmuellr/kbn-action/blob/master/README.md
	<!DOCTYPE html>
	<meta charset="utf-8">
	<link rel="stylesheet" type="text/css" href="./node_modules/@observablehq/inspector/dist/inspector.css">
	<body>
	<script type="module">
	import { Runtime, Inspector } from "./node_modules/@observablehq/runtime/dist/runtime.js";

	const runtime = new Runtime()
	const inspector = Inspector.into(document.body)
	const mod = runtime.module(define, inspector)
	DELETE _ilm/policy/event_log_policy
	DELETE _template/event_log_template
	DELETE event-log-000001
	DELETE event-log-000002

	PUT _ilm/policy/event_log_policy
	{
	"policy": {
	"phases": {
	"hot": {
	#!/usr/bin/env bash

	source ~/.kbn-fizz-buzz-secrets.sh

	ACTION_ID_SELOG=`kbn-action create .server-log "fizz-buzz server-log" "{}" "{}" \| jq -r ".id"`
	ACTION_ID_SLACK=`kbn-action create .slack "fizz-buzz slack" "{}" "{webhookUrl: '$SLACK_WEBHOOKURL'}" \| jq -r ".id"`
	ACTION_ID_EMAIL=`kbn-action create .email "fizz-buzz email" "{service: '$EMAIL_SERVICE', from: '$EMAIL_FROM'}" "{user: '$EMAIL_USER' password: '$EMAIL_PASSWORD'}" \| jq -r ".id"`
	ACTION_ID_INDEX=`kbn-action create .index "fizz-buzz index" "{index: 'fizz-buzz'}" "{}" \| jq -r ".id"`
	ACTION_ID_PDUTY=`kbn-action create .pagerduty "fizz-buzz pagerduty" "{}" "{routingKey: '$PAGERDUTY_ROUTING_KEY'}" \| jq -r ".id"`
	/*
	* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
	* or more contributor license agreements. Licensed under the Elastic License;
	* you may not use this file except in compliance with the Elastic License.
	*/

	type IAuditRecord = Record<string, any>;

	interface IAuditLog {
	initialize(): Promise<void>;
	#!/usr/bin/env bash

	# creates a number of alerts with a server-log action

	# Note that default alerttype - test.always-firing is part of the
	# alerting function tests, and writes documents to the index $GARBAGE_INDEX_NAME
	# specified below (it's uses it productively in tests, but not useful here).
	# So, if you use this default alerttype, you should be pointing your $KBN_URLBASE to
	# a Function Test Server.
	// path: x-pack/test/api_integration/fixtures/plugins/action_runner/index.ts

	/*
	* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
	* or more contributor license agreements. Licensed under the Elastic License;
	* you may not use this file except in compliance with the Elastic License.
	*/

	import Joi from 'joi';