Auto increase fields limit of the alert indices by ersin-erdal · Pull Request #216719 · elastic/kibana

ersin-erdal · 2025-04-01T20:55:24Z

This PR adds the auto-increase the fields limit on startup when an alerts index reaches its limits because of the dynamic fields.

To verify:

To be able to test this PR we need a rule type that adds dynamic fields.
I used the custom threshold rule for this:

Go to the custom threshold rule type definition and change its alerts.mappings to:

  mappings: {
    // dynamic: true,
    fieldMap: {
      'kibana.alerting.grouping': {
        type: 'object',
        dynamic: true,
        array: false,
        required: false,
      },
      ...legacyExperimentalFieldMap,
      ...Array(412)
        .fill(0)
        .reduce((acc, val, i) => {
          acc[`${i + 1}`] = { type: 'keyword', array: false, required: false };
          return acc;
        }, {}),
    },
    dynamicTemplates: [
      {
        strings_as_keywords: {
          path_match: 'kibana.alert.grouping.*',
          match_mapping_type: 'string',
          mapping: {
            type: 'keyword',
            ignore_above: 1024,
          },
        },
      },
    ],
  },

Above changes adds 412 dummy fields to the alerts index to make it close to reach its fields limit (default: 2500).
And makes everything under kibana.alert.grouping path to be added to the index as dynamic fields.

Then apply the below changes to the custom threshold rule executor:

const grouping: Record<string, string> = {};
      groups?.forEach((groupObj) => (grouping[groupObj.field] = groupObj.value));

      const { uuid, start } = alertsClient.report({
        id: `${group}`,
        actionGroup: actionGroupId,
        payload: {
          [ALERT_REASON]: reason,
          [ALERT_EVALUATION_VALUES]: evaluationValues,
          [ALERT_EVALUATION_THRESHOLD]: threshold,
          [ALERT_GROUP]: groups,
          // @ts-ignore
          ['kibana.alerting.grouping']: grouping,
          ...flattenAdditionalContext(additionalContext),
          ...getEcsGroups(groups),
        },
      });

Above changes add the selected groups under kibana.alerting.grouping path.

Then:

Run ES with path.data=../your-local-data-path to keep the data for the next start.
Run Kibana
Create a custom threshold rule that generates an alert and has at least 2 groups.
Let the rule run.
Go to Stack Management > Index Management and search for observability threshold index.
Check its mappings, it should show the dummy fields you have added to the rule type and the first grouping you have selected while you were creating the rule type.
Go to the Dev Tools and find your alert in the .internal.alerts-observability.threshold.alerts-default-000001 index.
The other groups you have selected should be saved under _ignored field:

"_ignored": [
     "kibana.alerting.grouping.host.name"
],

Stop Kibana
increase the number of dummy fields you have added to the rule type definition:

  ...Array(412) <-- make this greater than 412
        .fill(0)

Start kibana again.
The new fields should be added to the mappings. Check them on Stack Management > Index Management
Check also the index settings: Stack Management > Index Management > .internal.alerts-observability.threshold.alerts-default-000001 > settings tab.
"mapping" > "total_fields" > "limit" should be greater than 2500

…-fix'

…al/kibana into 283-auto-increase-fields-limit

elasticmachine · 2025-04-06T22:02:18Z

Pinging @elastic/response-ops (Team:ResponseOps)

ymao1

Verified works as described 🎉 . Left a few comments

ymao1 · 2025-04-09T14:14:22Z

...form/plugins/shared/alerting/server/alerts_service/lib/update_index_template_fileds_limit.ts

+import type { ElasticsearchClient } from '@kbn/core/server';
+import type { IndicesGetIndexTemplateIndexTemplateItem } from '@elastic/elasticsearch/lib/api/types';
+
+export const updateIndexTemplateFiledsLimit = ({


Suggested change

export const updateIndexTemplateFiledsLimit = ({

export const updateIndexTemplateFieldsLimit = ({

Can we update the filename as well?

ymao1 · 2025-04-09T14:26:04Z