Alerting v2 dispatcher by kdelemme · Pull Request #250822 · elastic/kibana

kdelemme · 2026-01-28T21:01:39Z

Resolves https://github.com/elastic/rna-program/issues/77

Summary

This PR introduces a basic Dispatcher service that looks for new alerts-events not yet dispatched, simulate fetching the rules and attached policies, and queuing the workflow calls, before inserting a "fire-event" alert action.
I've added a route to manually trigger the dispatcher, this is mostly for testing and demo purposes, but we might want to keep that as well for testing purposes.

Added some jest integration tests, but the setup is slow. It would be better if we could leverage some api integration tests, but that means the manual dispatcher run API should stay (and be deactivated in environment other than CI for example).

Things not done in this PR

Use the QueryService (we need to migrate the QueryService from data plugin to esClient before)
Fetch rules
Fetch policies
Handle suppression
Handle audit log of suppression
Queue workflow

Manual testing

Start clean

POST .alerts-events,.alerts-actions/_delete_by_query
{
  "query": { "match_all": {}}
}

Create a few alerts events for the same rule_id, group_hash

episode 1 : breached -> recovered
episode 2 : breached -> recovered
episode 3 : breached

POST _bulk
{ "create": { "_index": ".alerts-events" } }
{
    "@timestamp": "2026-01-27T16:00:00.000Z",
    "source": "internal",
    "type": "alert",
    "rule": {
        "id": "rule-4"
    },
    "group_hash": "rule-4-series-1",
    "episode_id": "rule-4-series-1-episode-1",
    "status": "breached",
    "episode_status": "active"
}
{ "create": { "_index": ".alerts-events" } }
{
    "@timestamp": "2026-01-27T16:01:00.000Z",
    "source": "internal",
    "type": "alert",
    "rule": {
        "id": "rule-4"
    },
    "group_hash": "rule-4-series-1",
    "episode_id": "rule-4-series-1-episode-1",
    "status": "recovered",
    "episode_status": "inactive"
}
{ "create": { "_index": ".alerts-events" } }
{
    "@timestamp": "2026-01-27T16:02:00.000Z",
    "source": "internal",
    "type": "alert",
    "rule": {
        "id": "rule-4"
    },
    "group_hash": "rule-4-series-1",
    "episode_id": "rule-4-series-1-episode-2",
    "status": "breached",
    "episode_status": "active"
}
{ "create": { "_index": ".alerts-events" } }
{
    "@timestamp": "2026-01-27T16:03:00.000Z",
    "source": "internal",
    "type": "alert",
    "rule": {
        "id": "rule-4"
    },
    "group_hash": "rule-4-series-1",
    "episode_id": "rule-4-series-1-episode-2",
    "status": "recovered",
    "episode_status": "inactive"
}
{ "create": { "_index": ".alerts-events" } }
{
    "@timestamp": "2026-01-27T16:04:00.000Z",
    "source": "internal",
    "type": "alert",
    "rule": {
        "id": "rule-4"
    },
    "group_hash": "rule-4-series-1",
    "episode_id": "rule-4-series-1-episode-3",
    "status": "breached",
    "episode_status": "active"
}

Run dispatcher

POST kbn:/internal/alerting/v2/dispatcher/_run
{ "previousStartedAt": "2026-01-27T16:00:00.000Z" }

Assert alert actions are created: We should have one by tuple (rule_id, group_hash, episode_id, episode_status) so 5 in this case

POST /_query?format=tsv
{
  "query": """FROM .alerts-actions | LIMIT 10000"""
}

@timestamp	action_type	actor	episode_id	expiry	group_hash	last_series_event_timestamp	rule_id	source
2026-01-28T21:05:24.144Z	fire-event	system			rule-4-series-1	2026-01-27T16:00:00.000Z	rule-4	internal
2026-01-28T21:05:23.105Z	fire-event	system			rule-4-series-1	2026-01-27T16:01:00.000Z	rule-4	internal
2026-01-28T21:05:21.063Z	fire-event	system			rule-4-series-1	2026-01-27T16:03:00.000Z	rule-4	internal
2026-01-28T21:05:22.080Z	fire-event	system			rule-4-series-1	2026-01-27T16:02:00.000Z	rule-4	internal
2026-01-28T21:05:20.339Z	fire-event	system			rule-4-series-1	2026-01-27T16:04:00.000Z	rule-4	internal

Run dispatcher again with same timestamp

POST kbn:/internal/alerting/v2/dispatcher/_run
{ "previousStartedAt": "2026-01-27T16:00:00.000Z" }

We should not have more alerts-actions (dedup works)

kdelemme · 2026-01-29T15:02:40Z

/ci

cnasikas

LGTM! To my understanding, the dispatcher will run periodically with a task? Will this be a work of an upcoming PR?

x-pack/platform/plugins/shared/alerting_v2/server/resources/alert_events.ts