Adding actionTypeId

elastic · Jun 2, 2021 · f99ecd0 · f99ecd0
1 parent 31c439f
commit f99ecd0
Show file tree

Hide file tree

Showing 6 changed files with 25 additions and 2 deletions.
diff --git a/x-pack/plugins/actions/server/lib/action_executor.ts b/x-pack/plugins/actions/server/lib/action_executor.ts
@@ -125,6 +125,7 @@ export class ActionExecutor {
       event: { action: EVENT_LOG_ACTIONS.execute },
       kibana: {
         alerting: {
+          action_type_id: actionTypeId,
           primary_saved_object: {
             id: actionId,
             type: 'action',

diff --git a/x-pack/plugins/event_log/generated/mappings.json b/x-pack/plugins/event_log/generated/mappings.json
@@ -247,6 +247,10 @@
                             "type": "keyword",
                             "ignore_above": 1024
                         },
+                        "action_type_id": {
+                            "type": "keyword",
+                            "ignore_above": 1024
+                        },
                         "instance_id": {
                             "type": "keyword",
                             "ignore_above": 1024

diff --git a/x-pack/plugins/event_log/generated/schemas.ts b/x-pack/plugins/event_log/generated/schemas.ts
@@ -105,6 +105,7 @@ export const EventSchema = schema.maybe(
           schema.object({
             action_group_id: ecsString(),
             action_subgroup: ecsString(),
+            action_type_id: ecsString(),
             instance_id: ecsString(),
             primary_saved_object: schema.maybe(
               schema.object({

diff --git a/x-pack/plugins/event_log/scripts/mappings.js b/x-pack/plugins/event_log/scripts/mappings.js
@@ -28,6 +28,10 @@ exports.EcsCustomPropertyMappings = {
             type: 'keyword',
             ignore_above: 1024,
           },
+          action_type_id: {
+            type: 'keyword',
+            ignore_above: 1024,
+          },
           instance_id: {
             type: 'keyword',
             ignore_above: 1024,

diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/execute.ts
@@ -119,6 +119,7 @@ export default function ({ getService }: FtrProviderContext) {
                 spaceId: space.id,
                 connectorId: createdAction.id,
                 outcome: 'success',
+                actionTypeId: 'test.index-record',
                 message: `action executed: test.index-record:${createdAction.id}: My action`,
               });
               break;
@@ -502,13 +503,14 @@ export default function ({ getService }: FtrProviderContext) {
   interface ValidateEventLogParams {
     spaceId: string;
     connectorId: string;
+    actionTypeId: string;
     outcome: string;
     message: string;
     errorMessage?: string;
   }
 
   async function validateEventLog(params: ValidateEventLogParams): Promise<void> {
-    const { spaceId, connectorId, outcome, message, errorMessage } = params;
+    const { spaceId, connectorId, actionTypeId, outcome, message, errorMessage } = params;
 
     const events: IValidatedEvent[] = await retry.try(async () => {
       return await getEventLog({
@@ -544,6 +546,7 @@ export default function ({ getService }: FtrProviderContext) {
 
     expect(event?.event?.outcome).to.equal(outcome);
 
+    expect(event?.kibana?.alerting?.action_type_id).to.equal(actionTypeId);
     expect(event?.kibana?.alerting?.primary_saved_object).to.eql({
       type: 'action',
       id: connectorId,

diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/actions/execute.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/actions/execute.ts
@@ -97,6 +97,7 @@ export default function ({ getService }: FtrProviderContext) {
       await validateEventLog({
         spaceId: Spaces.space1.id,
         actionId: createdAction.id,
+        actionTypeId: 'test.index-record',
         outcome: 'success',
         message: `action executed: test.index-record:${createdAction.id}: My action`,
       });
@@ -138,6 +139,7 @@ export default function ({ getService }: FtrProviderContext) {
       await validateEventLog({
         spaceId: Spaces.space1.id,
         actionId: createdAction.id,
+        actionTypeId: 'test.failing',
         outcome: 'failure',
         message: `action execution failure: test.failing:${createdAction.id}: failing action`,
         errorMessage: `an error occurred while running the action executor: expected failure for .kibana-alerting-test-data actions-failure-1:space1`,
@@ -330,13 +332,14 @@ export default function ({ getService }: FtrProviderContext) {
   interface ValidateEventLogParams {
     spaceId: string;
     actionId: string;
+    actionTypeId: string;
     outcome: string;
     message: string;
     errorMessage?: string;
   }
 
   async function validateEventLog(params: ValidateEventLogParams): Promise<void> {
-    const { spaceId, actionId, outcome, message, errorMessage } = params;
+    const { spaceId, actionId, actionTypeId, outcome, message, errorMessage } = params;
 
     const events: IValidatedEvent[] = await retry.try(async () => {
       return await getEventLog({
@@ -371,6 +374,13 @@ export default function ({ getService }: FtrProviderContext) {
 
     expect(event?.event?.outcome).to.equal(outcome);
 
+    expect(event?.kibana?.alerting?.action_type_id).to.equal(actionTypeId);
+    expect(event?.kibana?.alerting?.primary_saved_object).to.eql({
+      type: 'action',
+      id: actionId,
+      namespace: 'space1',
+    });
+
     expect(event?.kibana?.saved_objects).to.eql([
       {
         rel: 'primary',