Summary

Resolves #75382

Partially dependent on #84293 [Merged ✅]

Lots of edge cases to cover in this one so please take your time reviewing.

We now allow for index patterns that match indices with either the optionally provided timestamp override field or the default @timestamp to be used simultaneously when searching for events against our rules. Because some indices in a given index pattern may not have the timestamp override and/or @timestamp field, we now display a "partial failure" status for a rule to show when some indices were missing this and could not be searched against.

For this partial failure to be its most useful, the rule author should have at a minimum view_index_metadata for each index the rule is searching against. To provide more detailed messages it is also suggested for the rule author to have monitor privileges for all indices and monitor for the cluster as well. Without the monitor privilege we cannot provide detailed messages on which specific indices matching the given index patterns are missing the timestamp override field / @timestamp.

Partial failure example setup

Using the following indices

POST myfakeindex-1/_doc
{
  "message": "hello world 1"
}

POST myfakeindex-2/_doc
{
  "message": "hello world 2",
  "event": {
    "ingested": "2020-12-14T22:31:01.726Z"
  }
}

POST myfakeindex-3/_doc
{
  "message": "hello world 3",
  "@timestamp": "2020-12-14T22:31:01.726Z"
}

and a rule that searched *:* against the index pattern myfa* which matches all three indices above, we are able to search and produce signals against myfakeindex-2 and myfakeindex-3 thus the partial failure where we cannot search against myfakeindex-1 because it is missing both the timestamp override and the default @timestamp field from its mapping.

Full failure example setup

I deleted the indices myfakeindex-2 and myfakeindex-3 so that only myfakeindex-1 was left matching the myfa* index pattern, which did not have the timestamp override field nor the @timestamp field. A situation like this would generate the following error:

Screenshot full failure

Full failure no view_index_metadata screenshot

The following is the screenshot a user will see if the rule author did not have view_index_metadata privileges for the indices the rule searched against

Checklist

Delete any items that are not applicable to this PR.

• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• Any UI touched in this PR does not create any new axe failures (run axe in browser: FF, Chrome)

For maintainers

• This was checked for breaking API changes and was labeled appropriately