[MongoDB]: Add alerting rule templates

packages/mongodb/changelog.yml

@@ -1,3 +1,8 @@
+- version: "1.23.0"
+  changes:
+    - description: Package Alerting Rule Template.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/15866
 - version: "1.22.0"
   changes:
     - description: Allow @custom pipeline access to event.original without setting preserve_original_event.

packages/mongodb/data_stream/log/elasticsearch/ingest_pipeline/pipeline-json.yml

@@ -49,6 +49,11 @@ processors:
       - mongodb.log.truncated
       - mongodb.log.size
     ignore_missing: true
+- remove:
+    field: message
+    ignore_missing: true
+    if: 'ctx.event?.original != null'
+    description: 'The `message` field is no longer required if the document has an `event.original` field.'
 on_failure:
 - set:
     field: error.message

packages/mongodb/kibana/alerting_rule_template/mongodb-cache-usage-high.json

@@ -0,0 +1,33 @@
+{
+    "id": "mongodb-cache-usage-high",
+    "type": "alerting_rule_template",
+    "attributes": {
+        "name": "[MongoDB Resources] WiredTiger cache pressure",
+        "tags": [
+            "MongoDB",
+            "Resources"
+        ],
+        "ruleTypeId": ".es-query",
+        "schedule": {
+            "interval": "1m"
+        },
+        "params": {
+            "searchType": "esqlQuery",
+            "timeWindowSize": 5,
+            "timeWindowUnit": "m",
+            "esqlQuery": {
+                "esql": "FROM metrics-mongodb.status-default\n| WHERE @timestamp >= NOW() - 5 MINUTES\n| STATS cache_used=AVG(mongodb.status.wired_tiger.cache.used.bytes),\n        cache_max=AVG(mongodb.status.wired_tiger.cache.maximum.bytes) BY service.address\n| WHERE cache_max > 0\n| EVAL cache_usage_pct = (cache_used / cache_max) * 100\n| WHERE cache_usage_pct > 85"
+            },
+            "groupBy": "row",
+            "termSize": 5,
+            "timeField": "@timestamp"
+        },
+        "alertDelay": {
+            "active": 1
+        }
+    },
+    "managed": true,
+    "coreMigrationVersion": "8.8.0",
+    "typeMigrationVersion": "10.1.0"
+}
+

packages/mongodb/kibana/alerting_rule_template/mongodb-connection-usage-high.json

@@ -0,0 +1,33 @@
+{
+    "id": "mongodb-connection-usage-high",
+    "type": "alerting_rule_template",
+    "attributes": {
+        "name": "[MongoDB Availability] High connection usage",
+        "tags": [
+            "MongoDB",
+            "Availability"
+        ],
+        "ruleTypeId": ".es-query",
+        "schedule": {
+            "interval": "1m"
+        },
+        "params": {
+            "searchType": "esqlQuery",
+            "timeWindowSize": 5,
+            "timeWindowUnit": "m",
+            "esqlQuery": {
+                "esql": "FROM metrics-mongodb.status-default\n| WHERE @timestamp >= NOW() - 5 MINUTES\n| STATS current_conn=AVG(mongodb.status.connections.current),\n        available_conn=AVG(mongodb.status.connections.available) BY service.address\n| EVAL total_conn = current_conn + available_conn\n| WHERE total_conn > 0\n| EVAL connection_usage_pct = (current_conn / total_conn) * 100\n| WHERE connection_usage_pct > 80"
+            },
+            "groupBy": "row",
+            "termSize": 5,
+            "timeField": "@timestamp"
+        },
+        "alertDelay": {
+            "active": 1
+        }
+    },
+    "managed": true,
+    "coreMigrationVersion": "8.8.0",
+    "typeMigrationVersion": "10.1.0"
+}
+

packages/mongodb/kibana/alerting_rule_template/mongodb-oplog-headroom-critical.json

@@ -0,0 +1,33 @@
+{
+    "id": "mongodb-oplog-headroom-critical",
+    "type": "alerting_rule_template",
+    "attributes": {
+        "name": "[MongoDB Replication] Oplog headroom critically low",
+        "tags": [
+            "MongoDB",
+            "Replication"
+        ],
+        "ruleTypeId": ".es-query",
+        "schedule": {
+            "interval": "1m"
+        },
+        "params": {
+            "searchType": "esqlQuery",
+            "timeWindowSize": 5,
+            "timeWindowUnit": "m",
+            "esqlQuery": {
+                "esql": "FROM metrics-mongodb.replstatus-default\n| WHERE @timestamp >= NOW() - 5 MINUTES\n| STATS oplog_headroom_min=MIN(mongodb.replstatus.headroom.min) BY mongodb.replstatus.set_name\n| WHERE oplog_headroom_min < 900000"
+            },
+            "groupBy": "row",
+            "termSize": 5,
+            "timeField": "@timestamp"
+        },
+        "alertDelay": {
+            "active": 1
+        }
+    },
+    "managed": true,
+    "coreMigrationVersion": "8.8.0",
+    "typeMigrationVersion": "10.1.0"
+}
+

packages/mongodb/kibana/alerting_rule_template/mongodb-replica-member-down.json

@@ -0,0 +1,33 @@
+{
+    "id": "mongodb-replica-member-down",
+    "type": "alerting_rule_template",
+    "attributes": {
+        "name": "[MongoDB Replication] Replica member down",
+        "tags": [
+            "MongoDB",
+            "Replication"
+        ],
+        "ruleTypeId": ".es-query",
+        "schedule": {
+            "interval": "1m"
+        },
+        "params": {
+            "searchType": "esqlQuery",
+            "timeWindowSize": 5,
+            "timeWindowUnit": "m",
+            "esqlQuery": {
+                "esql": "FROM metrics-mongodb.replstatus-default\n| WHERE @timestamp >= NOW() - 5 MINUTES\n| STATS members_down=MAX(mongodb.replstatus.members.down.count) BY mongodb.replstatus.set_name\n| WHERE members_down > 0"
+            },
+            "groupBy": "row",
+            "termSize": 5,
+            "timeField": "@timestamp"
+        },
+        "alertDelay": {
+            "active": 1
+        }
+    },
+    "managed": true,
+    "coreMigrationVersion": "8.8.0",
+    "typeMigrationVersion": "10.1.0"
+}
+

packages/mongodb/kibana/alerting_rule_template/mongodb-replication-lag-high.json

@@ -0,0 +1,33 @@
+{
+    "id": "mongodb-replication-lag-high",
+    "type": "alerting_rule_template",
+    "attributes": {
+        "name": "[MongoDB Replication] High replication lag",
+        "tags": [
+            "MongoDB",
+            "Replication"
+        ],
+        "ruleTypeId": ".es-query",
+        "schedule": {
+            "interval": "1m"
+        },
+        "params": {
+            "searchType": "esqlQuery",
+            "timeWindowSize": 5,
+            "timeWindowUnit": "m",
+            "esqlQuery": {
+                "esql": "FROM metrics-mongodb.replstatus-default\n| WHERE @timestamp >= NOW() - 5 MINUTES\n| STATS replication_lag=MAX(mongodb.replstatus.lag.max) BY mongodb.replstatus.set_name\n| WHERE replication_lag > 10000"
+            },
+            "groupBy": "row",
+            "termSize": 5,
+            "timeField": "@timestamp"
+        },
+        "alertDelay": {
+            "active": 1
+        }
+    },
+    "managed": true,
+    "coreMigrationVersion": "8.8.0",
+    "typeMigrationVersion": "10.1.0"
+}
+

packages/mongodb/kibana/alerting_rule_template/mongodb-unhealthy-replica-members.json

@@ -0,0 +1,33 @@
+{
+    "id": "mongodb-unhealthy-replica-members",
+    "type": "alerting_rule_template",
+    "attributes": {
+        "name": "[MongoDB Replication] Unhealthy replica members",
+        "tags": [
+            "MongoDB",
+            "Replication"
+        ],
+        "ruleTypeId": ".es-query",
+        "schedule": {
+            "interval": "1m"
+        },
+        "params": {
+            "searchType": "esqlQuery",
+            "timeWindowSize": 5,
+            "timeWindowUnit": "m",
+            "esqlQuery": {
+                "esql": "FROM metrics-mongodb.replstatus-default\n| WHERE @timestamp >= NOW() - 5 MINUTES\n| STATS unhealthy_members=MAX(mongodb.replstatus.members.unhealthy.count) BY mongodb.replstatus.set_name\n| WHERE unhealthy_members > 0"
+            },
+            "groupBy": "row",
+            "termSize": 5,
+            "timeField": "@timestamp"
+        },
+        "alertDelay": {
+            "active": 1
+        }
+    },
+    "managed": true,
+    "coreMigrationVersion": "8.8.0",
+    "typeMigrationVersion": "10.1.0"
+}
+

packages/mongodb/manifest.yml

@@ -1,6 +1,6 @@
 name: mongodb
 title: MongoDB
-version: "1.22.0"
+version: "1.23.0"
 description: Collect logs and metrics from MongoDB instances with Elastic Agent.
 type: integration
 categories:
@@ -11,7 +11,7 @@ icons:
     title: logo mongodb
     size: 32x32
     type: image/svg+xml
-format_version: "3.0.2"
+format_version: "3.4.0"
 conditions:
   kibana:
     version: "^8.13.0 || ^9.0.0"