Kibana Dev Tools Console queries for the event log

kibana-dev-tools-console-event-log.txt

#-------------------------------------------------------
# get 1000 rule SO's
GET .kibana/_search
{
  "size": 1000,
  "query": {
    "bool": {
      "filter": [
        {"term": {"type": "alert"}}
      ]
    }
  }
}

#-------------------------------------------------------
# get 10 event log docs to see the structure

GET .kibana-event-log-7.14.0/_search

#-------------------------------------------------------
# count of rules by type and executions per type by Kibana server

GET .kibana-event-log-7.14.0/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {"range": {"@timestamp": {"gte": "now-1h"}}},
        {"term":  {"event.provider": "alerting"}},
        {"term":  {"event.action": "execute"}}
      ]
    }
  },
  "aggs": {
    "ruleTypes": {
      "terms": {"field": "rule.category"},
      "aggs": {
        "on server": {
          "terms": {"field": "kibana.server_uuid"},
          "aggs": {
            "rules for this ruleType": {
              "cardinality": {"field": "rule.id"}
            }
          }
        }
      }
    }
  }
}

#-------------------------------------------------------
# stats on rule duration by rule type

GET .kibana-event-log-7.14.0/_search
{
  "size": 0,
  "query": {
    "bool": {
      "filter": [
        {"range": {"@timestamp": {"gte": "now-1h"}}},
        {"term":  {"event.provider": "alerting"}},
        {"term":  {"event.action": "execute"}}
      ]
    }
  },
  "aggs": {
    "ruleTypes": {
      "terms": {"field": "rule.category"},
      "aggs": {
        "duration stats for this ruleType": {
          "stats": {"field": "event.duration.millis"}
        }
      }
    }
  },
  "runtime_mappings": {
    "event.duration.millis": {
      "type": "double",
      "script": {
        "source": "emit(doc['event.duration'].value / 1000000)"
      }
    }
  }
}

#-------------------------------------------------------
# most expensive rule execution durations

GET .kibana-event-log-7.14.0/_search?_source=false
{
  "size": 100,
  "query": {
    "bool": {
      "filter": [
        {"range": {"@timestamp": {"gte": "now-1h"}}},
        {"term":  {"event.provider": "alerting"}},
        {"term":  {"event.action": "execute"}}
      ]
    }
  },
  "sort" : [
    {"event.duration.millis" : {"order" : "desc"}}
  ],
  "fields": [
    "@timestamp",
    "kibana.server_uuid",
    "rule.category",
    "kibana.namespace",
    "rule.id",
    "rule.name",
    "event.duration.millis"
  ],
  "runtime_mappings": {
    "event.duration.millis": {
      "type": "double",
      "script": {
        "source": "emit(doc['event.duration'].value / 1000000)"
      }
    },
    "kibana.namespace": {
      "type": "keyword",
      "script": {
        "source": """
          def savedObjects = params._source["kibana"]["saved_objects"];
          if (savedObjects != null) {
            for (def savedObject : savedObjects) {
              emit(savedObject["namespace"])
            }  
          }
        """
      }
    }
  }
}