Describe the feature:
Bulk alert management functions on the AlertsClient, including bulkGet, bulkCreate, etc. The bulk functions should share authorization logic across alerts to reduce the CPU load compared to repeated calls to the non-bulk analogous function.
Proposed bulkGet implementation: https://github.com/marshallmain/kibana/blob/rules-status-aggs/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts#L386-L433
Specific use case:
On the detection engine rules management page we display the status of each rule and refresh the statuses periodically. Our rule status API currently calls AlertsClient.get for each rule on the page to retrieve the alerting framework status for the rule. Even though we use async to make the calls to AlertsClient.get, there is significant CPU cost in the authorization logic of get and the CPU usage ends up becoming the dominant factor when fetching hundreds of alert statuses. A bulk function that can fetch multiple alerts while sharing the same authorization would allow our status route to be much faster.
Other bulk routes would be useful as well. bulkCreate in particular would have immediate applications for the detection engine, as we have a bulk create route that makes repeated calls to the AlertsClient.create function.
Describe the feature:
Bulk alert management functions on the AlertsClient, including bulkGet, bulkCreate, etc. The bulk functions should share authorization logic across alerts to reduce the CPU load compared to repeated calls to the non-bulk analogous function.
Proposed
bulkGetimplementation: https://github.com/marshallmain/kibana/blob/rules-status-aggs/x-pack/plugins/alerting/server/alerts_client/alerts_client.ts#L386-L433Specific use case:
On the detection engine rules management page we display the status of each rule and refresh the statuses periodically. Our rule status API currently calls
AlertsClient.getfor each rule on the page to retrieve the alerting framework status for the rule. Even though we useasyncto make the calls toAlertsClient.get, there is significant CPU cost in the authorization logic ofgetand the CPU usage ends up becoming the dominant factor when fetching hundreds of alert statuses. A bulk function that can fetch multiple alerts while sharing the same authorization would allow our status route to be much faster.Other bulk routes would be useful as well.
bulkCreatein particular would have immediate applications for the detection engine, as we have a bulk create route that makes repeated calls to theAlertsClient.createfunction.