Skip to content

[Alerting v2] Rule authoring - Preview query and design parity#256818

Merged
dominiqueclarke merged 8 commits intoelastic:alerting_v2from
dominiqueclarke:feature/alerting-v2-query-test
Mar 11, 2026
Merged

[Alerting v2] Rule authoring - Preview query and design parity#256818
dominiqueclarke merged 8 commits intoelastic:alerting_v2from
dominiqueclarke:feature/alerting-v2-query-test

Conversation

@dominiqueclarke
Copy link
Copy Markdown
Contributor

@dominiqueclarke dominiqueclarke commented Mar 10, 2026

Summary

Resolves elastic/kibana#251335 (query testing)
Relates to elastic/kibana#255651 (design parity)
Relates to #256516 (removed enabled button)

This PR enhances the alerting-v2-rule-form package with layout-aware rule preview integration and form redesign.

Screenshot 2026-03-09 at 10 30 02 PM
Discover.-.Elastic.4.webm

Layout-aware Rule Preview

Introduces a RulePreviewPanel component that renders the rule and recovery results previews differently depending on where the form is rendered:

  • Page layout — previews render inline, side-by-side with the form
  • Flyout layout — previews render in a nested overlay flyout triggered by a "Preview results" button

This is powered by a new unified RuleFormProvider context (replacing the previous RuleFormServicesProvider) that carries both services and meta (including layout: 'page' | 'flyout'). The useRuleFormMeta() hook gives any descendant component access to the current layout mode.

Form UX Redesign

Rule details section:

  • Removed the FieldGroup panel wrapper — name, tags, and description now render without a bordered container
  • Replaced EuiFieldText name input with EuiInlineEditTitle for inline editing, showing "Untitled rule" as the default placeholder
  • Renamed "Labels" → "Tags" with an (optional) annotation via labelAppend
  • Removed EnabledField and KindField from this section

Field group panels:

  • FieldGroup now uses EuiSplitPanel with a subdued header for a cleaner panel look

Rule evaluation section:

  • Moved GroupFieldSelect and TimeFieldSelect from RuleExecutionFieldGroup into ConditionFieldGroup ("Rule evaluation")
  • Removed the description text paragraph from the condition field group
  • Marked Group Fields as optional with labelAppend

Rule kind:

  • Moved below RuleExecutionFieldGroup as a standalone field
  • Replaced EuiButtonGroup (Alert / Monitor toggle) with EuiCheckableCard (checkbox style)
  • Checked = kind: 'alert' (lifecycle management), unchecked = kind: 'signal' (observation-only)
  • Includes a bold label "Track active and recovered state over time" and a subdued description

Parent flyout:

  • Changed RuleFormFlyout size from "m" to "l"

New Components & Files

File Description
form/contexts/rule_form_context.tsx Unified context with RuleFormProvider, useRuleFormServices(), useRuleFormMeta()
form/fields/query_results_grid.tsx Shared EuiDataGrid panel with loading/empty/error states, grouping annotations, and pagination
form/fields/rule_results_preview.tsx Evaluation query preview (delegates to QueryResultsGrid)
form/fields/recovery_results_preview.tsx Recovery query preview (delegates to QueryResultsGrid)
form/fields/rule_preview_panel.tsx Layout-aware wrapper (inline for page, nested flyout for flyout)
form/hooks/query_key_factory.ts React Query key factory for preview cache deduplication
form/hooks/use_preview.ts Generic preview hook with debouncing, time filtering, and group computation

Test Coverage

  • Updated existing tests for NameField, KindField, RuleDetailsFieldGroup, and DynamicRuleForm to reflect the new component designs
  • Added new test files for QueryResultsGrid, RuleResultsPreview, RecoveryResultsPreview, RulePreviewPanel, and usePreview
  • usePreview tests specifically validate debouncing behavior: loading indicator during debounce wait, query suppression while pending, result persistence via keepPreviousData

Checklist

  • Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
  • Documentation was added for features that require explanation or tutorials
  • Unit or functional tests were updated or added to match the most common scenarios
  • If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
  • This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
  • Flaky Test Runner was used on any tests changed
  • The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
  • Review the backport guidelines and apply applicable backport:* labels.

Identify risks

  • Nested flyout compatibility: The nested EuiFlyout uses size="fill" to avoid EUI's managed flyout validation. If EUI changes this behavior, the nested preview flyout may need adjustment.
  • Debounce timing: The 2000ms debounce wait balances responsiveness with query load. Users typing slowly may perceive a delay before preview updates.
  • Context migration: RuleFormServicesProvider is preserved as a deprecated wrapper around RuleFormProvider for backward compatibility. External consumers should migrate to RuleFormProvider.

@github-actions github-actions bot added the author:actionable-obs PRs authored by the actionable obs team label Mar 10, 2026
@dominiqueclarke dominiqueclarke changed the title Feature/alerting v2 query test [Alerting v2] Rule authoring - Preview query Mar 10, 2026
@dominiqueclarke dominiqueclarke marked this pull request as ready for review March 10, 2026 02:29
@dominiqueclarke dominiqueclarke requested a review from a team as a code owner March 10, 2026 02:29
Comment on lines +70 to +75
/**
* @deprecated Use `RuleFormProvider` instead. Kept for backward compatibility.
*/
export const RuleFormServicesProvider: React.FC<
PropsWithChildren<{ services: RuleFormServices }>
> = ({ children, services }) => <RuleFormProvider services={services}>{children}</RuleFormProvider>;
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
/**
* @deprecated Use `RuleFormProvider` instead. Kept for backward compatibility.
*/
export const RuleFormServicesProvider: React.FC<
PropsWithChildren<{ services: RuleFormServices }>
> = ({ children, services }) => <RuleFormProvider services={services}>{children}</RuleFormProvider>;

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to remove this.

@dominiqueclarke dominiqueclarke changed the title [Alerting v2] Rule authoring - Preview query [Alerting v2] Rule authoring - Preview query Mar 10, 2026
@dominiqueclarke dominiqueclarke changed the title [Alerting v2] Rule authoring - Preview query [Alerting v2] Rule authoring - Preview query and design parity Mar 10, 2026
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 10, 2026

💔 Build Failed

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #56 / Dataset Quality Degraded fields flyout detecting root cause for ignored fields current field limit issues should display increase field limit as a possible mitigation for special packages like apm app
  • [job] [logs] FTR Configs #56 / Dataset Quality Degraded fields flyout detecting root cause for ignored fields current field limit issues should display increase field limit as a possible mitigation for special packages like apm app
  • [job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store CCS logs extraction (test against local instance) - Should run CCS extraction and write aggregated host entities to updates index
  • [job] [logs] Scout: [ security / entity_store ] plugin / local-stateful-classic - Entity Store CCS logs extraction (test against local instance) - Should run CCS extraction and write aggregated host entities to updates index
  • [job] [logs] FTR Configs #173 / serverless observability UI Dataset Quality Degraded fields flyout detecting root cause for ignored fields current field limit issues should display increase field limit as a possible mitigation for special packages like apm app
  • [job] [logs] FTR Configs #173 / serverless observability UI Dataset Quality Degraded fields flyout detecting root cause for ignored fields current field limit issues should display increase field limit as a possible mitigation for special packages like apm app

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [c732037]

History

Copy link
Copy Markdown
Contributor

@kdelemme kdelemme left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've tested locally and it works as expected.
Few comments/nits:

  1. is the rule name inline editor really something we want? saying this because I missed it the first time I created a rule...
  2. Can we have some refresh button on the preview table?
  3. The hooks (create/update rule) expects the services to be provided directly (http, notification), we can fetch these from within the hook directly (very nit)
  4. Not going to comment on the React.FC and the added comment lines but does your SKILLS work as expected?
  5. Would be very neat if the recovery query preview table would be displayed next to the recovery query, cf screenshot:
Image

@kdelemme kdelemme removed the request for review from a team March 11, 2026 15:56
@dominiqueclarke dominiqueclarke merged commit 8440a84 into elastic:alerting_v2 Mar 11, 2026
14 of 15 checks passed
@dominiqueclarke dominiqueclarke deleted the feature/alerting-v2-query-test branch March 11, 2026 16:41
darnautov added a commit that referenced this pull request Mar 27, 2026
## Summary

### Key capabilities

- **ES|QL-native rule evaluation** — Rules are defined as ES|QL queries
with optional WHERE clause conditions, evaluated on a configurable
schedule
- **Alert lifecycle management** — Full episode tracking with pending →
active → recovering → inactive state transitions, including configurable
alert delay (consecutive breaches / duration)
- **Event-driven architecture** — Alert events and actions are stored in
dedicated data streams (`.alerting-events`, `.alerting-actions`) with
ES|QL views for querying
- **Notification dispatch pipeline** — A multi-step dispatcher that
matches alert episodes to notification policies, handles
throttling/suppression, and triggers Kibana Workflows using encrypted
API keys
- **Notification policies** — CRUD APIs and UI for creating notification
policies with KQL-based rule matching, workflow integration, and API key
management
- **Rule authoring UI** — A shared rule form package
(`@kbn/alerting-v2-rule-form`) usable standalone or embedded in
Discover, with ES|QL editor, WHERE clause condition editing, recovery
configuration, and live query preview
- **Rule management UI** — Full rule list with pagination,
enable/disable, clone, edit, and delete operations
- **APM instrumentation** — Middleware and decorators for tracing rule
execution and client operations

### Architecture highlights

- **InversifyJS DI** — All services use constructor injection with typed
tokens, scoped per-request or singleton as appropriate
- **Pipeline pattern** — Rule executor and dispatcher use composable
step-based pipelines
- **Saved Objects** — Rules stored as hidden saved objects; notification
policies stored as encrypted saved objects (for API key protection)
- **Feature privileges** — Dedicated Kibana feature with read/all
privileges for RBAC

---

## Contained PRs

<details>
<summary><strong>Core Engine & Plugin Init</strong> (12 PRs)</summary>

- #247283 — Init alerting v2 plugin (@cnasikas)
- #247452 — Add the alerting v2 feature privileges (@cnasikas)
- #247673 — Director (@cnasikas)
- #248306 — Create basic services (@cnasikas)
- #248696 — Initialize all resources (@cnasikas)
- #250023 — Schema package (@cnasikas)
- #250010 — YML Editor (@cnasikas)
- #251064 — Remove index.mode: lookup for RnA alert indices (@cnasikas)
- #251707 — Simplify task registration pattern (@kdelemme)
- #251876 — Dedicated user service (@cnasikas)
- #252073 — Use `kbn/data-streams` in alerting_v2 (@cnasikas)
- #255120 — Update alerting-v2 owner to new rna project team (@cnasikas)

</details>

<details>
<summary><strong>Rule Execution Pipeline</strong> (12 PRs)</summary>

- #247472 — Add alerting v2 Rule Executor (@darnautov)
- #248285 — Alerting v2 rule HTTP APIs (@darnautov)
- #248728 — Add basic alert actions route (@darnautov)
- #250161 — Refactor rule executor to use a pipeline pattern
(@darnautov)
- #252292 — Implement the CountTimeframeStrategy for the director
(@cnasikas)
- #252544 — Add support of streaming in the rule executor (@darnautov)
- #252754 — Update rule attributes (@kdelemme)
- #253355 — Add getRules client method (@kdelemme)
- #253668 — Make evaluation.query.condition optional (@kdelemme)
- #254031 — Add recovery event generation to rule execution pipeline
(@kdelemme)
- #255968 — ES&#124;QL views (@adcoelho)
- #256697 — Create episodes ES&#124;QL view (@adcoelho)

</details>

<details>
<summary><strong>Alert Suppression & Episodes</strong> (3 PRs)</summary>

- #252174 — Alert suppression (@kdelemme)
- #256486 — Fix suppression query (@kdelemme)
- #256527 — Store 'unmatched' action for unmatched alert episodes
(@kdelemme)

</details>

<details>
<summary><strong>Dispatcher & Notification Engine</strong> (6
PRs)</summary>

- #250822 — Alerting v2 dispatcher (@kdelemme)
- #251529 — Use query service in dispatcher (@kdelemme)
- #251679 — Dispatcher task (@kdelemme)
- #252758 — Dispatcher notification policy (@kdelemme)
- #255332 — Wait for resources before scheduling dispatcher task
(@kdelemme)
- #256536 — Use stored encrypted API keys from Notification Policy in
dispatcher step (@kdelemme)

</details>

<details>
<summary><strong>Notification Policies (Server)</strong> (4
PRs)</summary>

- #251336 — Introduce notification policy CRUD APIs and client
(@cnasikas)
- #253134 — Update notification policy (@cnasikas)
- #254808 — Store API key owner on Notification Policy (@kdelemme)
- #256940 — Make notification policies global with optional rule-label
scoping (@kdelemme)

</details>

<details>
<summary><strong>Notification Policies UI</strong> (1 PR)</summary>

- #255599 — Add notification policies UI and Storybook form story
(@adcoelho)

</details>

<details>
<summary><strong>Rule Authoring UI</strong> (13 PRs)</summary>

- #250961 — Add create rule flyout in Discover (@adcoelho)
- #255111 — Add activation configuration fields to alerting V2 rule form
(@yiannisnikolopoulos)
- #255427 — Rule form: provide services via context (@dominiqueclarke)
- #255876 — MVP rule form, Split evaluation condition, and Recovery
configuration (@dominiqueclarke)
- #256260 — Foundational rule list (@dominiqueclarke)
- #256756 — Wire up edit flow (@dominiqueclarke)
- #256801 — Move consecutive breaches max to shared constants
(@yiannisnikolopoulos)
- #256818 — Preview query and design parity (@dominiqueclarke)
- #256938 — Allow clearing number inputs in state transition fields
(@yiannisnikolopoulos)
- #257017 — Add enable/disable and clone rule to rule list
(@dominiqueclarke)
- #257246 — Remove all React.FC (@dominiqueclarke)
- #257415 — Rule form - fix test (@dominiqueclarke)
- #257454 — Block comma key in number input component
(@yiannisnikolopoulos)

</details>

<details>
<summary><strong>API Documentation & Schema</strong> (2 PRs)</summary>

- #254901 — Rename indexes for alert events and actions (@adcoelho)
- #255810 — OAS for alert action routes (@adcoelho)

</details>

<details>
<summary><strong>Observability & Monitoring</strong> (3 PRs)</summary>

- #254925 — Add ApmMiddleware to the rule executor (@adcoelho)
- #255115 — Add the withAPM decorator and apply it to the rules_client
(@adcoelho)
- #255999 — Fix linting problem in apm middleware (@adcoelho)

</details>

<details>
<summary><strong>CI & Maintenance</strong> (2 PRs)</summary>

- #257409 — Refactor SO services to use inversify DI for client
initialization (@darnautov)
- Fix alerting-v2-schema jest config (@darnautov)

</details>

---

---------

Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Kevin Delemme <kevin.delemme@elastic.co>
Co-authored-by: Mike Côté <mikecote@users.noreply.github.com>
Co-authored-by: Antonio <antonio.coelho@elastic.co>
Co-authored-by: Kevin Delemme <kdelemme@gmail.com>
Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co>
Co-authored-by: Yiannis Nikolopoulos <yiannis.nikolopoulos@elastic.co>
Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Bailey Cash <bailey.cash@elastic.co>
Co-authored-by: Anna Davydova <ana.davydova@elastic.co>
Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com>
Co-authored-by: Joana Cardoso <169058851+joana-cps@users.noreply.github.com>
SoniaSanzV pushed a commit to SoniaSanzV/kibana that referenced this pull request Mar 30, 2026
## Summary

### Key capabilities

- **ES|QL-native rule evaluation** — Rules are defined as ES|QL queries
with optional WHERE clause conditions, evaluated on a configurable
schedule
- **Alert lifecycle management** — Full episode tracking with pending →
active → recovering → inactive state transitions, including configurable
alert delay (consecutive breaches / duration)
- **Event-driven architecture** — Alert events and actions are stored in
dedicated data streams (`.alerting-events`, `.alerting-actions`) with
ES|QL views for querying
- **Notification dispatch pipeline** — A multi-step dispatcher that
matches alert episodes to notification policies, handles
throttling/suppression, and triggers Kibana Workflows using encrypted
API keys
- **Notification policies** — CRUD APIs and UI for creating notification
policies with KQL-based rule matching, workflow integration, and API key
management
- **Rule authoring UI** — A shared rule form package
(`@kbn/alerting-v2-rule-form`) usable standalone or embedded in
Discover, with ES|QL editor, WHERE clause condition editing, recovery
configuration, and live query preview
- **Rule management UI** — Full rule list with pagination,
enable/disable, clone, edit, and delete operations
- **APM instrumentation** — Middleware and decorators for tracing rule
execution and client operations

### Architecture highlights

- **InversifyJS DI** — All services use constructor injection with typed
tokens, scoped per-request or singleton as appropriate
- **Pipeline pattern** — Rule executor and dispatcher use composable
step-based pipelines
- **Saved Objects** — Rules stored as hidden saved objects; notification
policies stored as encrypted saved objects (for API key protection)
- **Feature privileges** — Dedicated Kibana feature with read/all
privileges for RBAC

---

## Contained PRs

<details>
<summary><strong>Core Engine & Plugin Init</strong> (12 PRs)</summary>

- elastic#247283 — Init alerting v2 plugin (@cnasikas)
- elastic#247452 — Add the alerting v2 feature privileges (@cnasikas)
- elastic#247673 — Director (@cnasikas)
- elastic#248306 — Create basic services (@cnasikas)
- elastic#248696 — Initialize all resources (@cnasikas)
- elastic#250023 — Schema package (@cnasikas)
- elastic#250010 — YML Editor (@cnasikas)
- elastic#251064 — Remove index.mode: lookup for RnA alert indices (@cnasikas)
- elastic#251707 — Simplify task registration pattern (@kdelemme)
- elastic#251876 — Dedicated user service (@cnasikas)
- elastic#252073 — Use `kbn/data-streams` in alerting_v2 (@cnasikas)
- elastic#255120 — Update alerting-v2 owner to new rna project team (@cnasikas)

</details>

<details>
<summary><strong>Rule Execution Pipeline</strong> (12 PRs)</summary>

- elastic#247472 — Add alerting v2 Rule Executor (@darnautov)
- elastic#248285 — Alerting v2 rule HTTP APIs (@darnautov)
- elastic#248728 — Add basic alert actions route (@darnautov)
- elastic#250161 — Refactor rule executor to use a pipeline pattern
(@darnautov)
- elastic#252292 — Implement the CountTimeframeStrategy for the director
(@cnasikas)
- elastic#252544 — Add support of streaming in the rule executor (@darnautov)
- elastic#252754 — Update rule attributes (@kdelemme)
- elastic#253355 — Add getRules client method (@kdelemme)
- elastic#253668 — Make evaluation.query.condition optional (@kdelemme)
- elastic#254031 — Add recovery event generation to rule execution pipeline
(@kdelemme)
- elastic#255968 — ES&elastic#124;QL views (@adcoelho)
- elastic#256697 — Create episodes ES&elastic#124;QL view (@adcoelho)

</details>

<details>
<summary><strong>Alert Suppression & Episodes</strong> (3 PRs)</summary>

- elastic#252174 — Alert suppression (@kdelemme)
- elastic#256486 — Fix suppression query (@kdelemme)
- elastic#256527 — Store 'unmatched' action for unmatched alert episodes
(@kdelemme)

</details>

<details>
<summary><strong>Dispatcher & Notification Engine</strong> (6
PRs)</summary>

- elastic#250822 — Alerting v2 dispatcher (@kdelemme)
- elastic#251529 — Use query service in dispatcher (@kdelemme)
- elastic#251679 — Dispatcher task (@kdelemme)
- elastic#252758 — Dispatcher notification policy (@kdelemme)
- elastic#255332 — Wait for resources before scheduling dispatcher task
(@kdelemme)
- elastic#256536 — Use stored encrypted API keys from Notification Policy in
dispatcher step (@kdelemme)

</details>

<details>
<summary><strong>Notification Policies (Server)</strong> (4
PRs)</summary>

- elastic#251336 — Introduce notification policy CRUD APIs and client
(@cnasikas)
- elastic#253134 — Update notification policy (@cnasikas)
- elastic#254808 — Store API key owner on Notification Policy (@kdelemme)
- elastic#256940 — Make notification policies global with optional rule-label
scoping (@kdelemme)

</details>

<details>
<summary><strong>Notification Policies UI</strong> (1 PR)</summary>

- elastic#255599 — Add notification policies UI and Storybook form story
(@adcoelho)

</details>

<details>
<summary><strong>Rule Authoring UI</strong> (13 PRs)</summary>

- elastic#250961 — Add create rule flyout in Discover (@adcoelho)
- elastic#255111 — Add activation configuration fields to alerting V2 rule form
(@yiannisnikolopoulos)
- elastic#255427 — Rule form: provide services via context (@dominiqueclarke)
- elastic#255876 — MVP rule form, Split evaluation condition, and Recovery
configuration (@dominiqueclarke)
- elastic#256260 — Foundational rule list (@dominiqueclarke)
- elastic#256756 — Wire up edit flow (@dominiqueclarke)
- elastic#256801 — Move consecutive breaches max to shared constants
(@yiannisnikolopoulos)
- elastic#256818 — Preview query and design parity (@dominiqueclarke)
- elastic#256938 — Allow clearing number inputs in state transition fields
(@yiannisnikolopoulos)
- elastic#257017 — Add enable/disable and clone rule to rule list
(@dominiqueclarke)
- elastic#257246 — Remove all React.FC (@dominiqueclarke)
- elastic#257415 — Rule form - fix test (@dominiqueclarke)
- elastic#257454 — Block comma key in number input component
(@yiannisnikolopoulos)

</details>

<details>
<summary><strong>API Documentation & Schema</strong> (2 PRs)</summary>

- elastic#254901 — Rename indexes for alert events and actions (@adcoelho)
- elastic#255810 — OAS for alert action routes (@adcoelho)

</details>

<details>
<summary><strong>Observability & Monitoring</strong> (3 PRs)</summary>

- elastic#254925 — Add ApmMiddleware to the rule executor (@adcoelho)
- elastic#255115 — Add the withAPM decorator and apply it to the rules_client
(@adcoelho)
- elastic#255999 — Fix linting problem in apm middleware (@adcoelho)

</details>

<details>
<summary><strong>CI & Maintenance</strong> (2 PRs)</summary>

- elastic#257409 — Refactor SO services to use inversify DI for client
initialization (@darnautov)
- Fix alerting-v2-schema jest config (@darnautov)

</details>

---

---------

Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Kevin Delemme <kevin.delemme@elastic.co>
Co-authored-by: Mike Côté <mikecote@users.noreply.github.com>
Co-authored-by: Antonio <antonio.coelho@elastic.co>
Co-authored-by: Kevin Delemme <kdelemme@gmail.com>
Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co>
Co-authored-by: Yiannis Nikolopoulos <yiannis.nikolopoulos@elastic.co>
Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Bailey Cash <bailey.cash@elastic.co>
Co-authored-by: Anna Davydova <ana.davydova@elastic.co>
Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com>
Co-authored-by: Joana Cardoso <169058851+joana-cps@users.noreply.github.com>
jeramysoucy pushed a commit to jeramysoucy/kibana that referenced this pull request Apr 1, 2026
- **ES|QL-native rule evaluation** — Rules are defined as ES|QL queries
with optional WHERE clause conditions, evaluated on a configurable
schedule
- **Alert lifecycle management** — Full episode tracking with pending →
active → recovering → inactive state transitions, including configurable
alert delay (consecutive breaches / duration)
- **Event-driven architecture** — Alert events and actions are stored in
dedicated data streams (`.alerting-events`, `.alerting-actions`) with
ES|QL views for querying
- **Notification dispatch pipeline** — A multi-step dispatcher that
matches alert episodes to notification policies, handles
throttling/suppression, and triggers Kibana Workflows using encrypted
API keys
- **Notification policies** — CRUD APIs and UI for creating notification
policies with KQL-based rule matching, workflow integration, and API key
management
- **Rule authoring UI** — A shared rule form package
(`@kbn/alerting-v2-rule-form`) usable standalone or embedded in
Discover, with ES|QL editor, WHERE clause condition editing, recovery
configuration, and live query preview
- **Rule management UI** — Full rule list with pagination,
enable/disable, clone, edit, and delete operations
- **APM instrumentation** — Middleware and decorators for tracing rule
execution and client operations

- **InversifyJS DI** — All services use constructor injection with typed
tokens, scoped per-request or singleton as appropriate
- **Pipeline pattern** — Rule executor and dispatcher use composable
step-based pipelines
- **Saved Objects** — Rules stored as hidden saved objects; notification
policies stored as encrypted saved objects (for API key protection)
- **Feature privileges** — Dedicated Kibana feature with read/all
privileges for RBAC

---

<details>
<summary><strong>Core Engine & Plugin Init</strong> (12 PRs)</summary>

- elastic#247283 — Init alerting v2 plugin (@cnasikas)
- elastic#247452 — Add the alerting v2 feature privileges (@cnasikas)
- elastic#247673 — Director (@cnasikas)
- elastic#248306 — Create basic services (@cnasikas)
- elastic#248696 — Initialize all resources (@cnasikas)
- elastic#250023 — Schema package (@cnasikas)
- elastic#250010 — YML Editor (@cnasikas)
- elastic#251064 — Remove index.mode: lookup for RnA alert indices (@cnasikas)
- elastic#251707 — Simplify task registration pattern (@kdelemme)
- elastic#251876 — Dedicated user service (@cnasikas)
- elastic#252073 — Use `kbn/data-streams` in alerting_v2 (@cnasikas)
- elastic#255120 — Update alerting-v2 owner to new rna project team (@cnasikas)

</details>

<details>
<summary><strong>Rule Execution Pipeline</strong> (12 PRs)</summary>

- elastic#247472 — Add alerting v2 Rule Executor (@darnautov)
- elastic#248285 — Alerting v2 rule HTTP APIs (@darnautov)
- elastic#248728 — Add basic alert actions route (@darnautov)
- elastic#250161 — Refactor rule executor to use a pipeline pattern
(@darnautov)
- elastic#252292 — Implement the CountTimeframeStrategy for the director
(@cnasikas)
- elastic#252544 — Add support of streaming in the rule executor (@darnautov)
- elastic#252754 — Update rule attributes (@kdelemme)
- elastic#253355 — Add getRules client method (@kdelemme)
- elastic#253668 — Make evaluation.query.condition optional (@kdelemme)
- elastic#254031 — Add recovery event generation to rule execution pipeline
(@kdelemme)
- elastic#255968 — ES&elastic#124;QL views (@adcoelho)
- elastic#256697 — Create episodes ES&elastic#124;QL view (@adcoelho)

</details>

<details>
<summary><strong>Alert Suppression & Episodes</strong> (3 PRs)</summary>

- elastic#252174 — Alert suppression (@kdelemme)
- elastic#256486 — Fix suppression query (@kdelemme)
- elastic#256527 — Store 'unmatched' action for unmatched alert episodes
(@kdelemme)

</details>

<details>
<summary><strong>Dispatcher & Notification Engine</strong> (6
PRs)</summary>

- elastic#250822 — Alerting v2 dispatcher (@kdelemme)
- elastic#251529 — Use query service in dispatcher (@kdelemme)
- elastic#251679 — Dispatcher task (@kdelemme)
- elastic#252758 — Dispatcher notification policy (@kdelemme)
- elastic#255332 — Wait for resources before scheduling dispatcher task
(@kdelemme)
- elastic#256536 — Use stored encrypted API keys from Notification Policy in
dispatcher step (@kdelemme)

</details>

<details>
<summary><strong>Notification Policies (Server)</strong> (4
PRs)</summary>

- elastic#251336 — Introduce notification policy CRUD APIs and client
(@cnasikas)
- elastic#253134 — Update notification policy (@cnasikas)
- elastic#254808 — Store API key owner on Notification Policy (@kdelemme)
- elastic#256940 — Make notification policies global with optional rule-label
scoping (@kdelemme)

</details>

<details>
<summary><strong>Notification Policies UI</strong> (1 PR)</summary>

- elastic#255599 — Add notification policies UI and Storybook form story
(@adcoelho)

</details>

<details>
<summary><strong>Rule Authoring UI</strong> (13 PRs)</summary>

- elastic#250961 — Add create rule flyout in Discover (@adcoelho)
- elastic#255111 — Add activation configuration fields to alerting V2 rule form
(@yiannisnikolopoulos)
- elastic#255427 — Rule form: provide services via context (@dominiqueclarke)
- elastic#255876 — MVP rule form, Split evaluation condition, and Recovery
configuration (@dominiqueclarke)
- elastic#256260 — Foundational rule list (@dominiqueclarke)
- elastic#256756 — Wire up edit flow (@dominiqueclarke)
- elastic#256801 — Move consecutive breaches max to shared constants
(@yiannisnikolopoulos)
- elastic#256818 — Preview query and design parity (@dominiqueclarke)
- elastic#256938 — Allow clearing number inputs in state transition fields
(@yiannisnikolopoulos)
- elastic#257017 — Add enable/disable and clone rule to rule list
(@dominiqueclarke)
- elastic#257246 — Remove all React.FC (@dominiqueclarke)
- elastic#257415 — Rule form - fix test (@dominiqueclarke)
- elastic#257454 — Block comma key in number input component
(@yiannisnikolopoulos)

</details>

<details>
<summary><strong>API Documentation & Schema</strong> (2 PRs)</summary>

- elastic#254901 — Rename indexes for alert events and actions (@adcoelho)
- elastic#255810 — OAS for alert action routes (@adcoelho)

</details>

<details>
<summary><strong>Observability & Monitoring</strong> (3 PRs)</summary>

- elastic#254925 — Add ApmMiddleware to the rule executor (@adcoelho)
- elastic#255115 — Add the withAPM decorator and apply it to the rules_client
(@adcoelho)
- elastic#255999 — Fix linting problem in apm middleware (@adcoelho)

</details>

<details>
<summary><strong>CI & Maintenance</strong> (2 PRs)</summary>

- elastic#257409 — Refactor SO services to use inversify DI for client
initialization (@darnautov)
- Fix alerting-v2-schema jest config (@darnautov)

</details>

---

---------

Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Kevin Delemme <kevin.delemme@elastic.co>
Co-authored-by: Mike Côté <mikecote@users.noreply.github.com>
Co-authored-by: Antonio <antonio.coelho@elastic.co>
Co-authored-by: Kevin Delemme <kdelemme@gmail.com>
Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co>
Co-authored-by: Yiannis Nikolopoulos <yiannis.nikolopoulos@elastic.co>
Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Bailey Cash <bailey.cash@elastic.co>
Co-authored-by: Anna Davydova <ana.davydova@elastic.co>
Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com>
Co-authored-by: Joana Cardoso <169058851+joana-cps@users.noreply.github.com>
jeramysoucy pushed a commit to jeramysoucy/kibana that referenced this pull request Apr 1, 2026
- **ES|QL-native rule evaluation** — Rules are defined as ES|QL queries
with optional WHERE clause conditions, evaluated on a configurable
schedule
- **Alert lifecycle management** — Full episode tracking with pending →
active → recovering → inactive state transitions, including configurable
alert delay (consecutive breaches / duration)
- **Event-driven architecture** — Alert events and actions are stored in
dedicated data streams (`.alerting-events`, `.alerting-actions`) with
ES|QL views for querying
- **Notification dispatch pipeline** — A multi-step dispatcher that
matches alert episodes to notification policies, handles
throttling/suppression, and triggers Kibana Workflows using encrypted
API keys
- **Notification policies** — CRUD APIs and UI for creating notification
policies with KQL-based rule matching, workflow integration, and API key
management
- **Rule authoring UI** — A shared rule form package
(`@kbn/alerting-v2-rule-form`) usable standalone or embedded in
Discover, with ES|QL editor, WHERE clause condition editing, recovery
configuration, and live query preview
- **Rule management UI** — Full rule list with pagination,
enable/disable, clone, edit, and delete operations
- **APM instrumentation** — Middleware and decorators for tracing rule
execution and client operations

- **InversifyJS DI** — All services use constructor injection with typed
tokens, scoped per-request or singleton as appropriate
- **Pipeline pattern** — Rule executor and dispatcher use composable
step-based pipelines
- **Saved Objects** — Rules stored as hidden saved objects; notification
policies stored as encrypted saved objects (for API key protection)
- **Feature privileges** — Dedicated Kibana feature with read/all
privileges for RBAC

---

<details>
<summary><strong>Core Engine & Plugin Init</strong> (12 PRs)</summary>

- elastic#247283 — Init alerting v2 plugin (@cnasikas)
- elastic#247452 — Add the alerting v2 feature privileges (@cnasikas)
- elastic#247673 — Director (@cnasikas)
- elastic#248306 — Create basic services (@cnasikas)
- elastic#248696 — Initialize all resources (@cnasikas)
- elastic#250023 — Schema package (@cnasikas)
- elastic#250010 — YML Editor (@cnasikas)
- elastic#251064 — Remove index.mode: lookup for RnA alert indices (@cnasikas)
- elastic#251707 — Simplify task registration pattern (@kdelemme)
- elastic#251876 — Dedicated user service (@cnasikas)
- elastic#252073 — Use `kbn/data-streams` in alerting_v2 (@cnasikas)
- elastic#255120 — Update alerting-v2 owner to new rna project team (@cnasikas)

</details>

<details>
<summary><strong>Rule Execution Pipeline</strong> (12 PRs)</summary>

- elastic#247472 — Add alerting v2 Rule Executor (@darnautov)
- elastic#248285 — Alerting v2 rule HTTP APIs (@darnautov)
- elastic#248728 — Add basic alert actions route (@darnautov)
- elastic#250161 — Refactor rule executor to use a pipeline pattern
(@darnautov)
- elastic#252292 — Implement the CountTimeframeStrategy for the director
(@cnasikas)
- elastic#252544 — Add support of streaming in the rule executor (@darnautov)
- elastic#252754 — Update rule attributes (@kdelemme)
- elastic#253355 — Add getRules client method (@kdelemme)
- elastic#253668 — Make evaluation.query.condition optional (@kdelemme)
- elastic#254031 — Add recovery event generation to rule execution pipeline
(@kdelemme)
- elastic#255968 — ES&elastic#124;QL views (@adcoelho)
- elastic#256697 — Create episodes ES&elastic#124;QL view (@adcoelho)

</details>

<details>
<summary><strong>Alert Suppression & Episodes</strong> (3 PRs)</summary>

- elastic#252174 — Alert suppression (@kdelemme)
- elastic#256486 — Fix suppression query (@kdelemme)
- elastic#256527 — Store 'unmatched' action for unmatched alert episodes
(@kdelemme)

</details>

<details>
<summary><strong>Dispatcher & Notification Engine</strong> (6
PRs)</summary>

- elastic#250822 — Alerting v2 dispatcher (@kdelemme)
- elastic#251529 — Use query service in dispatcher (@kdelemme)
- elastic#251679 — Dispatcher task (@kdelemme)
- elastic#252758 — Dispatcher notification policy (@kdelemme)
- elastic#255332 — Wait for resources before scheduling dispatcher task
(@kdelemme)
- elastic#256536 — Use stored encrypted API keys from Notification Policy in
dispatcher step (@kdelemme)

</details>

<details>
<summary><strong>Notification Policies (Server)</strong> (4
PRs)</summary>

- elastic#251336 — Introduce notification policy CRUD APIs and client
(@cnasikas)
- elastic#253134 — Update notification policy (@cnasikas)
- elastic#254808 — Store API key owner on Notification Policy (@kdelemme)
- elastic#256940 — Make notification policies global with optional rule-label
scoping (@kdelemme)

</details>

<details>
<summary><strong>Notification Policies UI</strong> (1 PR)</summary>

- elastic#255599 — Add notification policies UI and Storybook form story
(@adcoelho)

</details>

<details>
<summary><strong>Rule Authoring UI</strong> (13 PRs)</summary>

- elastic#250961 — Add create rule flyout in Discover (@adcoelho)
- elastic#255111 — Add activation configuration fields to alerting V2 rule form
(@yiannisnikolopoulos)
- elastic#255427 — Rule form: provide services via context (@dominiqueclarke)
- elastic#255876 — MVP rule form, Split evaluation condition, and Recovery
configuration (@dominiqueclarke)
- elastic#256260 — Foundational rule list (@dominiqueclarke)
- elastic#256756 — Wire up edit flow (@dominiqueclarke)
- elastic#256801 — Move consecutive breaches max to shared constants
(@yiannisnikolopoulos)
- elastic#256818 — Preview query and design parity (@dominiqueclarke)
- elastic#256938 — Allow clearing number inputs in state transition fields
(@yiannisnikolopoulos)
- elastic#257017 — Add enable/disable and clone rule to rule list
(@dominiqueclarke)
- elastic#257246 — Remove all React.FC (@dominiqueclarke)
- elastic#257415 — Rule form - fix test (@dominiqueclarke)
- elastic#257454 — Block comma key in number input component
(@yiannisnikolopoulos)

</details>

<details>
<summary><strong>API Documentation & Schema</strong> (2 PRs)</summary>

- elastic#254901 — Rename indexes for alert events and actions (@adcoelho)
- elastic#255810 — OAS for alert action routes (@adcoelho)

</details>

<details>
<summary><strong>Observability & Monitoring</strong> (3 PRs)</summary>

- elastic#254925 — Add ApmMiddleware to the rule executor (@adcoelho)
- elastic#255115 — Add the withAPM decorator and apply it to the rules_client
(@adcoelho)
- elastic#255999 — Fix linting problem in apm middleware (@adcoelho)

</details>

<details>
<summary><strong>CI & Maintenance</strong> (2 PRs)</summary>

- elastic#257409 — Refactor SO services to use inversify DI for client
initialization (@darnautov)
- Fix alerting-v2-schema jest config (@darnautov)

</details>

---

---------

Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Kevin Delemme <kevin.delemme@elastic.co>
Co-authored-by: Mike Côté <mikecote@users.noreply.github.com>
Co-authored-by: Antonio <antonio.coelho@elastic.co>
Co-authored-by: Kevin Delemme <kdelemme@gmail.com>
Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co>
Co-authored-by: Yiannis Nikolopoulos <yiannis.nikolopoulos@elastic.co>
Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Bailey Cash <bailey.cash@elastic.co>
Co-authored-by: Anna Davydova <ana.davydova@elastic.co>
Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com>
Co-authored-by: Joana Cardoso <169058851+joana-cps@users.noreply.github.com>
paulinashakirova pushed a commit to paulinashakirova/kibana that referenced this pull request Apr 2, 2026
## Summary

### Key capabilities

- **ES|QL-native rule evaluation** — Rules are defined as ES|QL queries
with optional WHERE clause conditions, evaluated on a configurable
schedule
- **Alert lifecycle management** — Full episode tracking with pending →
active → recovering → inactive state transitions, including configurable
alert delay (consecutive breaches / duration)
- **Event-driven architecture** — Alert events and actions are stored in
dedicated data streams (`.alerting-events`, `.alerting-actions`) with
ES|QL views for querying
- **Notification dispatch pipeline** — A multi-step dispatcher that
matches alert episodes to notification policies, handles
throttling/suppression, and triggers Kibana Workflows using encrypted
API keys
- **Notification policies** — CRUD APIs and UI for creating notification
policies with KQL-based rule matching, workflow integration, and API key
management
- **Rule authoring UI** — A shared rule form package
(`@kbn/alerting-v2-rule-form`) usable standalone or embedded in
Discover, with ES|QL editor, WHERE clause condition editing, recovery
configuration, and live query preview
- **Rule management UI** — Full rule list with pagination,
enable/disable, clone, edit, and delete operations
- **APM instrumentation** — Middleware and decorators for tracing rule
execution and client operations

### Architecture highlights

- **InversifyJS DI** — All services use constructor injection with typed
tokens, scoped per-request or singleton as appropriate
- **Pipeline pattern** — Rule executor and dispatcher use composable
step-based pipelines
- **Saved Objects** — Rules stored as hidden saved objects; notification
policies stored as encrypted saved objects (for API key protection)
- **Feature privileges** — Dedicated Kibana feature with read/all
privileges for RBAC

---

## Contained PRs

<details>
<summary><strong>Core Engine & Plugin Init</strong> (12 PRs)</summary>

- elastic#247283 — Init alerting v2 plugin (@cnasikas)
- elastic#247452 — Add the alerting v2 feature privileges (@cnasikas)
- elastic#247673 — Director (@cnasikas)
- elastic#248306 — Create basic services (@cnasikas)
- elastic#248696 — Initialize all resources (@cnasikas)
- elastic#250023 — Schema package (@cnasikas)
- elastic#250010 — YML Editor (@cnasikas)
- elastic#251064 — Remove index.mode: lookup for RnA alert indices (@cnasikas)
- elastic#251707 — Simplify task registration pattern (@kdelemme)
- elastic#251876 — Dedicated user service (@cnasikas)
- elastic#252073 — Use `kbn/data-streams` in alerting_v2 (@cnasikas)
- elastic#255120 — Update alerting-v2 owner to new rna project team (@cnasikas)

</details>

<details>
<summary><strong>Rule Execution Pipeline</strong> (12 PRs)</summary>

- elastic#247472 — Add alerting v2 Rule Executor (@darnautov)
- elastic#248285 — Alerting v2 rule HTTP APIs (@darnautov)
- elastic#248728 — Add basic alert actions route (@darnautov)
- elastic#250161 — Refactor rule executor to use a pipeline pattern
(@darnautov)
- elastic#252292 — Implement the CountTimeframeStrategy for the director
(@cnasikas)
- elastic#252544 — Add support of streaming in the rule executor (@darnautov)
- elastic#252754 — Update rule attributes (@kdelemme)
- elastic#253355 — Add getRules client method (@kdelemme)
- elastic#253668 — Make evaluation.query.condition optional (@kdelemme)
- elastic#254031 — Add recovery event generation to rule execution pipeline
(@kdelemme)
- elastic#255968 — ES&elastic#124;QL views (@adcoelho)
- elastic#256697 — Create episodes ES&elastic#124;QL view (@adcoelho)

</details>

<details>
<summary><strong>Alert Suppression & Episodes</strong> (3 PRs)</summary>

- elastic#252174 — Alert suppression (@kdelemme)
- elastic#256486 — Fix suppression query (@kdelemme)
- elastic#256527 — Store 'unmatched' action for unmatched alert episodes
(@kdelemme)

</details>

<details>
<summary><strong>Dispatcher & Notification Engine</strong> (6
PRs)</summary>

- elastic#250822 — Alerting v2 dispatcher (@kdelemme)
- elastic#251529 — Use query service in dispatcher (@kdelemme)
- elastic#251679 — Dispatcher task (@kdelemme)
- elastic#252758 — Dispatcher notification policy (@kdelemme)
- elastic#255332 — Wait for resources before scheduling dispatcher task
(@kdelemme)
- elastic#256536 — Use stored encrypted API keys from Notification Policy in
dispatcher step (@kdelemme)

</details>

<details>
<summary><strong>Notification Policies (Server)</strong> (4
PRs)</summary>

- elastic#251336 — Introduce notification policy CRUD APIs and client
(@cnasikas)
- elastic#253134 — Update notification policy (@cnasikas)
- elastic#254808 — Store API key owner on Notification Policy (@kdelemme)
- elastic#256940 — Make notification policies global with optional rule-label
scoping (@kdelemme)

</details>

<details>
<summary><strong>Notification Policies UI</strong> (1 PR)</summary>

- elastic#255599 — Add notification policies UI and Storybook form story
(@adcoelho)

</details>

<details>
<summary><strong>Rule Authoring UI</strong> (13 PRs)</summary>

- elastic#250961 — Add create rule flyout in Discover (@adcoelho)
- elastic#255111 — Add activation configuration fields to alerting V2 rule form
(@yiannisnikolopoulos)
- elastic#255427 — Rule form: provide services via context (@dominiqueclarke)
- elastic#255876 — MVP rule form, Split evaluation condition, and Recovery
configuration (@dominiqueclarke)
- elastic#256260 — Foundational rule list (@dominiqueclarke)
- elastic#256756 — Wire up edit flow (@dominiqueclarke)
- elastic#256801 — Move consecutive breaches max to shared constants
(@yiannisnikolopoulos)
- elastic#256818 — Preview query and design parity (@dominiqueclarke)
- elastic#256938 — Allow clearing number inputs in state transition fields
(@yiannisnikolopoulos)
- elastic#257017 — Add enable/disable and clone rule to rule list
(@dominiqueclarke)
- elastic#257246 — Remove all React.FC (@dominiqueclarke)
- elastic#257415 — Rule form - fix test (@dominiqueclarke)
- elastic#257454 — Block comma key in number input component
(@yiannisnikolopoulos)

</details>

<details>
<summary><strong>API Documentation & Schema</strong> (2 PRs)</summary>

- elastic#254901 — Rename indexes for alert events and actions (@adcoelho)
- elastic#255810 — OAS for alert action routes (@adcoelho)

</details>

<details>
<summary><strong>Observability & Monitoring</strong> (3 PRs)</summary>

- elastic#254925 — Add ApmMiddleware to the rule executor (@adcoelho)
- elastic#255115 — Add the withAPM decorator and apply it to the rules_client
(@adcoelho)
- elastic#255999 — Fix linting problem in apm middleware (@adcoelho)

</details>

<details>
<summary><strong>CI & Maintenance</strong> (2 PRs)</summary>

- elastic#257409 — Refactor SO services to use inversify DI for client
initialization (@darnautov)
- Fix alerting-v2-schema jest config (@darnautov)

</details>

---

---------

Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Kevin Delemme <kevin.delemme@elastic.co>
Co-authored-by: Mike Côté <mikecote@users.noreply.github.com>
Co-authored-by: Antonio <antonio.coelho@elastic.co>
Co-authored-by: Kevin Delemme <kdelemme@gmail.com>
Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.rhodes@elastic.co>
Co-authored-by: Yiannis Nikolopoulos <yiannis.nikolopoulos@elastic.co>
Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Bailey Cash <bailey.cash@elastic.co>
Co-authored-by: Anna Davydova <ana.davydova@elastic.co>
Co-authored-by: Umberto Pepato <umbopepato@users.noreply.github.com>
Co-authored-by: Jason Rhodes <jason.matthew.rhodes@gmail.com>
Co-authored-by: Joana Cardoso <169058851+joana-cps@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author:actionable-obs PRs authored by the actionable obs team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants