Skip to content

Commit 20387b0

Browse files
elasticmachineelasticmachine
authored
Merge branch 'master' into fix-index-pattern-refresh-bug
2 parents 2b81cbc + 5adccd0 commit 20387b0

455 files changed

Lines changed: 4923 additions & 3651 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎docs/images/vega_lite_default.png‎

285 KB
Loading

‎docs/setup/production.asciidoc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,8 @@ server.port
133133
Settings that must be the same:
134134
--------
135135
xpack.security.encryptionKey //decrypting session cookies
136-
xpack.reporting.encryptionKey //decrypting reports stored in Elasticsearch
136+
xpack.reporting.encryptionKey //decrypting reports
137+
xpack.encryptedSavedObjects.encryptionKey // decrypting saved objects
137138
--------
138139

139140
Separate configuration files can be used from the command line by using the `-c` flag:

‎docs/user/alerting/action-types/pagerduty.asciidoc‎

Lines changed: 128 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,142 @@
44

55
The PagerDuty action type uses the https://v2.developer.pagerduty.com/docs/events-api-v2[v2 Events API] to trigger, acknowledge, and resolve PagerDuty alerts.
66

7+
* <<pagerduty-benefits, PagerDuty and Elastic integration benefits>>
8+
* <<pagerduty-connector-configuration, Connector configuration>>
9+
* <<pagerduty-action-configuration, Action configuration>>
10+
11+
[float]
12+
[[pagerduty-benefits]]
13+
=== PagerDuty + Elastic integration benefits
14+
15+
By integrating PagerDuty with alerts, you can:
16+
17+
* Route your alerts to the right PagerDuty responder within your team, based on your structure, escalation policies, and workflows.
18+
* Automatically generate incidents of different types and severity based on each alert’s context.
19+
* Tailor the incident data to match your needs by easily passing the alerting context from Kibana to PagerDuty.
20+
21+
[float]
22+
[[pagerduty-how-it-works]]
23+
==== How it works
24+
25+
{kib} allows you to create alerts to notify you of a significant move
26+
in your dataset.
27+
You can create alerts for all your Observability, Security, and Elastic Stack use cases.
28+
Alerts will trigger a new incident on the corresponding PagerDuty service.
29+
30+
[float]
31+
==== Requirements
32+
33+
In the `kibana.yml` configuration file, you must add the <<general-alert-action-settings, saved objects encryption setting>>.
34+
This is required to encrypt parameters that must be secured, for example PagerDuty’s integration key.
35+
36+
If you have security enabled:
37+
38+
* You must have
39+
application privileges to access Metrics, APM, Uptime, or SIEM.
40+
* If you are using a self-managed deployment with security, you must have
41+
Transport Security Layer (TLS) enabled for communication <<configuring-tls-kib-es, between Elasticsearch and Kibana>>.
42+
Alerts uses API keys to secure background alert checks and actions,
43+
and API keys require {ref}/configuring-tls.html#tls-http[TLS on the HTTP interface].
44+
45+
Although not a requirement, to harden the integrations security you might want to
46+
review the <<action-settings, Actions settings>> that are available to you.
47+
48+
[float]
49+
[[pagerduty-support]]
50+
==== Support
51+
If you need help with this integration, get in touch with the {kib} team by visiting
52+
https://support.elastic.co[support.elastic.co] or by using the *Ask Elastic* option in the {kib} Help menu.
53+
You can also select the {kib} category at https://discuss.elastic.co/[discuss.elastic.co].
54+
55+
[float]
56+
[[pagerduty-integration-walkthrough]]
57+
==== Integration with PagerDuty walkthrough
58+
59+
[float]
60+
[[pagerduty-in-pagerduty]]
61+
===== In PagerDuty
62+
63+
. From the *Configuration* menu, select *Services*.
64+
. Add an integration to a service:
65+
+
66+
* If you are adding your integration to an existing service,
67+
click the name of the service you want to add the integration to.
68+
Then, select the *Integrations* tab and click the *New Integration* button.
69+
* If you are creating a new service for your integration,
70+
go to
71+
https://support.pagerduty.com/docs/services-and-integrations#section-configuring-services-and-integrations[Configuring Services and Integrations]
72+
and follow the steps outlined in the *Create a New Service* section, selecting *Elastic* as the *Integration Type* in step 4.
73+
Continue with the <<pagerduty-in-elastic, In Elastic>> section once you have finished these steps.
74+
75+
. Enter an *Integration Name* in the format Elastic-service-name (for example, Elastic-Alerting or Kibana-APM-Alerting)
76+
and select Elastic from the *Integration Type* menu.
77+
. Click *Add Integration* to save your new integration.
78+
+
79+
You will be redirected to the *Integrations* tab for your service. An Integration Key is generated on this screen.
80+
+
81+
[role="screenshot"]
82+
image::user/alerting/images/pagerduty-integration.png[PagerDuty Integrations tab]
83+
84+
. Save this key, as you will use it when you configure the integration with Elastic in the next section.
85+
86+
[float]
87+
[[pagerduty-in-elastic]]
88+
===== In Elastic
89+
90+
. Create a PagerDuty Connector in Kibana. You can:
91+
+
92+
* Create a connector as part of creating an alert by selecting PagerDuty in the *Actions*
93+
section of the alert configuration and selecting *Add new*.
94+
* Alternatively, create a connector by navigating to *Management* from the {kib} navbar and selecting
95+
*Alerts and Actions*. Then, select the *Connectors* tab, click the *Create connector* button, and select the PagerDuty option.
96+
97+
. Configure the connector by giving it a name and optionally entering the API URL and Routing Key, or using the defaults.
98+
+
99+
See <<pagerduty-in-pagerduty, In PagerDuty>> for how to obtain the endpoint and key information from PagerDuty and
100+
<<pagerduty-connector-configuration, Connector configuration>> for more details.
101+
102+
. Save the Connector.
103+
104+
. Create an alert using *Management > Alerts and Actions* or the application of your choice.
105+
106+
. Set up an action using your PagerDuty connector, by determining:
107+
+
108+
* The action’s type: Trigger, Resolve, or Acknowledge.
109+
* The event’s severity: Info, warning, error, or critical.
110+
* An array of different fields, including the timestamp, group, class, component, and your dedup key.
111+
Depending on your custom needs, assign them variables from the alerting context.
112+
To see the available context variables, click on the *Add alert variable* icon next
113+
to each corresponding field. For more details on these parameters, see the
114+
<<pagerduty-action-configuration, Actions Configuration>> and the PagerDuty
115+
https://v2.developer.pagerduty.com/v2/docs/send-an-event-events-api-v2[API v2 documentation].
116+
117+
118+
[float]
119+
[[pagerduty-uninstall]]
120+
==== How to uninstall
121+
To remove a PagerDuty connector from an alert, simply remove it
122+
from the *Actions* section of that alert, using the remove (x) icon.
123+
This will disable the integration for the particular alert.
124+
125+
To delete the connector entirely, go to *Management > Alerts and Actions*.
126+
Select the *Connectors* tab, and then click on the delete icon.
127+
This is an irreversible action and impacts all alerts that use this connector.
128+
129+
7130
[float]
8131
[[pagerduty-connector-configuration]]
9-
==== Connector configuration
132+
=== Connector configuration
10133

11134
PagerDuty connectors have the following configuration properties:
12135

13136
Name:: The name of the connector. The name is used to identify a connector in the management UI connector listing, or in the connector list when configuring an action.
14-
API URL:: An optional PagerDuty event URL. Defaults to `https://events.pagerduty.com/v2/enqueue`. If you are using the <<action-settings, `xpack.actions.whitelistedHosts`>> setting, make sure the hostname is whitelisted.
137+
API URL:: An optional PagerDuty event URL. Defaults to `https://events.pagerduty.com/v2/enqueue`. If you are using the <<action-settings, `xpack.actions.whitelistedHosts`>> setting, make sure the hostname is whitelisted.
15138
Routing Key:: A 32 character PagerDuty Integration Key for an integration on a service or on a global ruleset.
16139

17140
[float]
18141
[[pagerduty-action-configuration]]
19-
==== Action configuration
142+
=== Action configuration
20143

21144
PagerDuty actions have the following properties:
22145

@@ -26,8 +149,8 @@ Dedup Key:: All actions sharing this key will be associated with the same Pa
26149
Timestamp:: An *optional* https://v2.developer.pagerduty.com/v2/docs/types#datetime[ISO-8601 format date-time], indicating the time the event was detected or generated.
27150
Component:: An *optional* value indicating the component of the source machine that is responsible for the event, for example `mysql` or `eth0`.
28151
Group:: An *optional* value indicating the logical grouping of components of a service, for example `app-stack`.
29-
Source:: An *optional* value indicating the affected system, preferably a hostname or fully qualified domain name. Defaults to the {kib} saved object id of the action.
152+
Source:: An *optional* value indicating the affected system, preferably a hostname or fully qualified domain name. Defaults to the {kib} saved object id of the action.
30153
Summary:: An *optional* text summary of the event, defaults to `No summary provided`. The maximum length is 1024 characters.
31154
Class:: An *optional* value indicating the class/type of the event, for example `ping failure` or `cpu load`.
32155

33-
For more details on these properties, see https://v2.developer.pagerduty.com/v2/docs/send-an-event-events-api-v2[PagerDuty v2 event parameters].
156+
For more details on these properties, see https://v2.developer.pagerduty.com/v2/docs/send-an-event-events-api-v2[PagerDuty v2 event parameters].

‎docs/user/alerting/images/pagerduty-integration.png‎

86.6 KB
Loading

0 commit comments

Comments
 (0)