PPL Alerting: Get Alerts and Alert Lifecycle #1972

toepkerd · 2025-11-02T20:03:31Z

Description

Get Alerts and Alert Lifecycle

ITs depend on execute monitor functionality that has not yet been published, but they have been written:

Alerts Lifecycle ITs: https://github.com/toepkerd/alerting/blob/ppl-main/alerting/src/test/kotlin/org/opensearch/alerting/alertsv2/AlertV2IndicesIT.kt
Get Alerts RBAC ITs: https://github.com/toepkerd/alerting/blob/ec4672e6321f7665e5059d7103f619725d2eb254/alerting/src/test/kotlin/org/opensearch/alerting/resthandler/SecureMonitorV2RestApiIT.kt#L629

Related Issues

#1880

Check List

[Y] New functionality includes testing.
New functionality has been documented.
API changes companion pull request created.
[Y] Commits are signed per the DCO using --signoff.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Dennis Toepker <[email protected]>

eirsep · 2025-11-03T16:37:24Z

alerting/src/main/kotlin/org/opensearch/alerting/actionv2/GetAlertsV2Request.kt

+    val monitorV2Id: String?
+    val monitorV2Ids: List<String>?
+    val alertV2Ids: List<String>?
+    val boolQueryBuilder: BoolQueryBuilder?


do we intend to support BoolQueryBuilder in API? user prolly wouldn't know Alert structure and this could be a security issue i reckon if user is able to query alerts by User fields,

It was not an explicit product requirement, but I chose to include it with V1 users migrating to V2 in mind.

We can instead simplify the API to have similar functionality but not require them to create the query.

Have later decided to do this ^. I've actually removed boolQueryBuilder outright, as well as the alertV2Ids filter.

alerting/src/main/kotlin/org/opensearch/alerting/actionv2/GetAlertsV2Request.kt

eirsep · 2025-11-03T16:42:21Z

alerting/src/main/kotlin/org/opensearch/alerting/actionv2/GetAlertsV2Response.kt

+    @Throws(IOException::class)
+    override fun toXContent(builder: XContentBuilder, params: ToXContent.Params): XContentBuilder {
+        builder.startObject()
+            .field("alertV2s", alertV2s)


"v2alerts" ? also do we do camel_case or snake_case

will change to snake case, but will also retain the alerts v2 ordering of names

eirsep · 2025-11-03T16:42:49Z

alerting/src/main/kotlin/org/opensearch/alerting/actionv2/GetAlertsV2Response.kt

+    override fun toXContent(builder: XContentBuilder, params: ToXContent.Params): XContentBuilder {
+        builder.startObject()
+            .field("alertV2s", alertV2s)
+            .field("totalAlertV2s", totalAlertV2s)


no page information? is this API paginated?

Less paginated and more capped. Users can specify a size param in the API to indicate how many alerts they want returned.

@eirsep the total alerts is how many alerts there are and that can be higher than the alerts response sent. Then the use can use the start index in the request to get the next page. Though it would be good to indicate the start and end index in the response to make it easier to paginate.

Raised this Github issue to include start/end index in get alerts response: #1976

eirsep · 2025-11-03T16:45:32Z

alerting/src/main/kotlin/org/opensearch/alerting/transportv2/TransportGetAlertsV2Action.kt

+            actionListener.onFailure(
+                AlertingException.wrap(
+                    OpenSearchStatusException(
+                        "Alerting V2 is currently disabled, please enable it with the " +


users can't change cluster settings (in managed service atleast). this is not the expected behaviour imo

We will be pushing a CR that allowlists this setting to be adjustable by users.

We are also setting the flag to enabled by default, despite initial PPL Alerting launch being experimental.

eirsep · 2025-11-03T16:48:07Z

alerting/src/main/kotlin/org/opensearch/alerting/actionv2/GetAlertsV2Request.kt

+        monitorV2Id: String?,
+        monitorV2Ids: List<String>? = null,


plz dont support both
this is a poor practice adopted in V1 due to BWC restrictions. We should remove monitorV2Id String

+1, just use the list.

will remove individual monitorV2Id support

eirsep · 2025-11-03T16:49:08Z

alerting/src/main/kotlin/org/opensearch/alerting/actionv2/GetAlertsV2Request.kt

+import org.opensearch.index.query.BoolQueryBuilder
+import java.io.IOException
+
+class GetAlertsV2Request : ActionRequest {


serde unit tests

Signed-off-by: Dennis Toepker <[email protected]>

… request and response Signed-off-by: Dennis Toepker <[email protected]>

alerting/src/main/kotlin/org/opensearch/alerting/alertsv2/AlertV2Mover.kt

alerting/src/main/resources/org/opensearch/alerting/alertsv2/alert_v2_mapping.json

Signed-off-by: Dennis Toepker <[email protected]>

lezzago · 2025-11-03T21:38:29Z

alerting/src/main/kotlin/org/opensearch/alerting/alertsv2/AlertV2Mover.kt

+        // first collect all active alerts
+        val allAlertsSearchQuery = SearchSourceBuilder.searchSource()
+            .query(QueryBuilders.matchAllQuery())
+            .size(10000)


what happens when there are more than 10,000 alerts? We should paginate

Added this Github issue to better handle the pagination case with scrolling: #1967

lezzago · 2025-11-03T21:39:48Z

alerting/src/main/kotlin/org/opensearch/alerting/alertsv2/AlertV2Mover.kt

+            val triggerV2Id = alertV2.triggerId
+            val triggeredTime = alertV2.triggeredTime.toEpochMilli()
+
+            val expireDuration = triggerToExpireDuration[triggerV2Id]


Have we confirmed we will use the latest trigger expiration time here? So even if the alert was created when the expiration was 1 year and got changed to 1 day, it will expire after a day the alert was generated?

Yes, we have received product-side confirmation that alert expiration will happen at the trigger level and not alert level.

lezzago · 2025-11-03T21:40:31Z

alerting/src/main/kotlin/org/opensearch/alerting/alertsv2/AlertV2Mover.kt

+
+            val alertsSearchQuery = SearchSourceBuilder.searchSource()
+                .query(boolQuery)
+                .size(10000)


pagination?

Added this Github issue to better handle the pagination case with scrolling: #1967

lezzago · 2025-11-03T21:43:42Z

There seems to be no integration tests on alerts. We need normal integration tests and security tests which includes RBAC.

toepkerd · 2025-11-03T21:53:23Z

Alert ITs are included here: https://github.com/toepkerd/alerting/blob/ppl-main/alerting/src/test/kotlin/org/opensearch/alerting/alertsv2/AlertV2IndicesIT.kt

They are not published in this PR because execute monitor functionality hasn't yet been published. However, I believe Get Alerts ITs for RBAC are still in order, will add those.

EDIT: added, see description

Signed-off-by: Dennis Toepker <[email protected]>

toepkerd-zz added 2 commits November 2, 2025 11:51

PPL Alerting: Get Alerts and Alert Lifecycle

b2f7cb8

Signed-off-by: Dennis Toepker <[email protected]>

updating scheduled jobs schema version in alert indices IT

f4bffa1

Signed-off-by: Dennis Toepker <[email protected]>

toepkerd force-pushed the ppl-review branch from 3d91e6c to f4bffa1 Compare November 3, 2025 01:41

toepkerd marked this pull request as ready for review November 3, 2025 05:13

toepkerd requested review from AWSHurneyt, amsiglan, bowenlan-amzn, eirsep, engechas, getsaurabh02, goyamegh, jowg-amazon, lezzago, praveensameneni, rishabhmaurya, riysaxen-amzn and sbcd90 as code owners November 3, 2025 05:13

eirsep reviewed Nov 3, 2025

View reviewed changes

alerting/src/main/kotlin/org/opensearch/alerting/actionv2/GetAlertsV2Request.kt Show resolved Hide resolved

eirsep reviewed Nov 3, 2025

View reviewed changes

toepkerd-zz added 3 commits November 3, 2025 12:16

enabling alerting v2 by default

acc68f7

Signed-off-by: Dennis Toepker <[email protected]>

making get alerts response fields snake cased

d12bf64

Signed-off-by: Dennis Toepker <[email protected]>

removing unused get alerts params and adding serde tests for alertsv2…

42dcb2e

… request and response Signed-off-by: Dennis Toepker <[email protected]>

toepkerd force-pushed the ppl-review branch from cdc49e0 to 42dcb2e Compare November 3, 2025 20:16

AWSHurneyt reviewed Nov 3, 2025

View reviewed changes

removing misleading comments

cbf4f12

Signed-off-by: Dennis Toepker <[email protected]>

lezzago reviewed Nov 3, 2025

View reviewed changes

minor changes

f67ebdb

Signed-off-by: Dennis Toepker <[email protected]>

PPL Alerting: Get Alerts and Alert Lifecycle #1972

Are you sure you want to change the base?

PPL Alerting: Get Alerts and Alert Lifecycle #1972

Uh oh!

Conversation

toepkerd commented Nov 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issues

Check List

Uh oh!

eirsep Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

toepkerd Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lezzago Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lezzago commented Nov 3, 2025

Uh oh!

toepkerd commented Nov 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

toepkerd commented Nov 2, 2025 •

edited

Loading

eirsep Nov 3, 2025 •

edited

Loading

toepkerd Nov 3, 2025 •

edited

Loading

lezzago Nov 3, 2025 •

edited

Loading

toepkerd commented Nov 3, 2025 •

edited

Loading