pmuellr

sequenceDiagram
    participant Client
    participant Proxy
    participant Target
    Client->>Proxy: HTTP CONNECT target.example.com:80 
    Proxy->>Target: open socket to target.example.com:80
    Proxy->>Client: empty 200 OK status response ...
    Proxy->>Client: ..but leave socket open from client
 Note over Proxy: Proxy now just passes bytes btween client and target

pmuellr

/*
 * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
 * or more contributor license agreements. Licensed under the Elastic License
 * 2.0; you may not use this file except in compliance with the Elastic License
 * 2.0.
 */

// starts http and https proxies to use to test actions within Kibana

const fs = require('fs');

pmuellr

{
  "$schema": "https://vega.github.io/schema/vega-lite/v5.json",
  "description": "task manager tasks",
  "data": {"values": [
    {"worker": 0, "begin": 0, "duration": 1, "type": "i" },
    {"worker": 0, "begin": 3, "duration": 1, "type": "i"  },
    {"worker": 0, "begin": 6, "duration": 1, "type": "i"  },
    {"worker": 0, "begin": 9, "duration": 1, "type": "i"  },
    {"worker": 1, "begin": 0, "duration": 4, "type": "o"  },
    {"worker": 1, "begin": 6, "duration": 2, "type": "s"  }

pmuellr

sequenceDiagram
    participant I as IPad / html
    participant S as Server / deno
    participant D as DesktopBrowser / html
    participant L as Launchpad / native device
    
    D ->>	L: Find Launchpad
    activate L
    L ->>	D: Found Launchpad

pmuellr

#!/usr/bin/env node

'use strict'

/*
Filter for Elastic Kibana .ndjson files with alerting rule exports,
that converts all the rule's actions to a new server log connector.

node export-to-server-log.js < original-export.ndjson > modified-export.ndjson
*/

pmuellr

#-------------------------------------------------------
# get 1000 rule SO's
GET .kibana/_search
{
  "size": 1000,
  "query": {
    "bool": {
      "filter": [
        {"term": {"type": "alert"}}
      ]

pmuellr

{"attributes":{"fieldAttrs":"{\"event.outcome\":{\"count\":3},\"kibana.alerting.status\":{\"count\":5},\"message\":{\"count\":7},\"event.action\":{\"count\":4},\"kibana.alerting.action_group_id\":{\"count\":2},\"kibana.alerting.instance_id\":{\"count\":2},\"event.duration\":{\"count\":7},\"error.message\":{\"count\":4},\"event.end\":{\"count\":1},\"event.reason\":{\"count\":2},\"event.start\":{\"count\":1},\"rule.id\":{\"count\":1},\"kibana.spaceId\":{\"count\":1}}","fieldFormatMap":"{\"event.duration\":{\"id\":\"duration\",\"params\":{\"inputFormat\":\"nanoseconds\",\"outputFormat\":\"asSeconds\",\"showSuffix\":true,\"useShortSuffix\":true}},\"event.duration.ms\":{\"id\":\"duration\",\"params\":{\"inputFormat\":\"milliseconds\",\"outputFormat\":\"asMilliseconds\",\"showSuffix\":true,\"useShortSuffix\":true}}}","fields":"[]","runtimeFieldMap":"{\"event.duration.ms\":{\"type\":\"long\",\"script\":{\"source\":\"def duration = doc['event.duration'];\\nif (duration == null) return;\\nif (duration.size() == 0) ret

pmuellr

{"attributes":{"fieldAttrs":"{\"soid\":{\"count\":4},\"_id\":{\"count\":1},\"event.action\":{\"count\":1},\"event.duration\":{\"count\":1},\"event.provider\":{\"count\":1},\"kibana.alerting.status\":{\"count\":1}}","fieldFormatMap":"{\"event.duration\":{\"id\":\"duration\",\"params\":{\"inputFormat\":\"nanoseconds\",\"outputFormat\":\"asMilliseconds\",\"outputPrecision\":0,\"showSuffix\":false}}}","fields":"[]","runtimeFieldMap":"{\"soid\":{\"type\":\"keyword\",\"script\":{\"source\":\"def savedObjects = params._source[\\\"kibana\\\"][\\\"saved_objects\\\"];\\n\\nif (savedObjects != null) {\\n  for (def savedObject : savedObjects) {\\n    emit(savedObject[\\\"type\\\"] + \\\":\\\" + savedObject[\\\"id\\\"])\\n  }  \\n}\"}}}","timeFieldName":"@timestamp","title":".kibana-event-log-*"},"coreMigrationVersion":"7.13.2","id":"119d36c0-ce30-11eb-9885-59d424b49d0b","migrationVersion":{"index-pattern":"7.11.0"},"references":[],"type":"index-pattern","updated_at":"2021-06-16T03:14:42.635Z","version":"WzYzNTQ1LDFd"}
{"

pmuellr

{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{\"event.duration\":{\"id\":\"duration\",\"params\":{\"inputFormat\":\"nanoseconds\",\"outputFormat\":\"asMilliseconds\",\"showSuffix\":true,\"useShortSuffix\":true,\"includeSpaceWithSuffix\":true}}}","fields":"[]","runtimeFieldMap":"{\"soid\":{\"type\":\"keyword\",\"script\":{\"source\":\"def savedObjects = params._source[\\\"kibana\\\"][\\\"saved_objects\\\"];\\n\\nif (savedObjects != null) {\\n  for (def savedObject : savedObjects) {\\n    emit(savedObject[\\\"type\\\"] + \\\":\\\" + savedObject[\\\"id\\\"])\\n  }  \\n}\\n\"}}}","timeFieldName":"@timestamp","title":".kibana-event-log-*","typeMeta":"{}"},"coreMigrationVersion":"8.0.0","id":"cd94ad50-c4c0-11eb-a329-07149b9b0aad","migrationVersion":{"index-pattern":"7.11.0"},"references":[],"type":"index-pattern","updated_at":"2021-06-03T23:25:41.302Z","version":"WzY4Nzg3LDFd"}
{"attributes":{"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"language\":\"kuery\",\"query\":\"

pmuellr

// runtime field definition to add to .kibana-event-log index patterns
// I name the field `soid`, which will have either alert or action ids, or both
// prefixed by their type.  Useful for Discover and Lens.
// For Kibana >= 7.13.0

def savedObjects = params._source["kibana"]["saved_objects"];

if (savedObjects.length > 0) {
  emit(savedObjects[0]["type"] + ":" + savedObjects[0]["id"]);
}