[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 #242024
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
doakalexi
changed the title
doakalexi
added
release_note:skip
Contributor
|
Pinging @elastic/response-ops (Team:ResponseOps) |
georgianaonoleata1904
approved these changes
Nov 7, 2025
Contributor
georgianaonoleata1904
left a comment
georgianaonoleata1904
left a comment
There was a problem hiding this comment.
Tested locally and works as expected.
Contributor
💚 Build Succeeded
Metrics [docs]
|
Contributor
|
Starting backport for target branches: 8.19, 9.1, 9.2 |
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Nov 10, 2025
… when alert delay is set to more than 1 (elastic#242024) Resolves elastic#239852 ## Summary This PR fixes a bug where active alerts aren't created when flapping is disabled and the alert delay feature is used. This bug was happening bc the flapping code created clones of active and recovered alert objects for tracking in the state. When flapping is disabled this code is skipped, so when the active and recovered alerts are deleted from their objects they are also deleted in the objects tracking active and recovered alerts. This PR clones the active and recovered objects before any flapping or alert delay processing to fix this bug. ### Checklist Check the PR satisfies following conditions. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### To verify 1. Set flapping to be disabled in the rule settings 2. Create an alert and set the alert delay to be 2 3. Verify that the alert delay feature delays the alert as expected and the alert actually gets created. (cherry picked from commit 5d2171a)
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Nov 10, 2025
… when alert delay is set to more than 1 (elastic#242024) Resolves elastic#239852 ## Summary This PR fixes a bug where active alerts aren't created when flapping is disabled and the alert delay feature is used. This bug was happening bc the flapping code created clones of active and recovered alert objects for tracking in the state. When flapping is disabled this code is skipped, so when the active and recovered alerts are deleted from their objects they are also deleted in the objects tracking active and recovered alerts. This PR clones the active and recovered objects before any flapping or alert delay processing to fix this bug. ### Checklist Check the PR satisfies following conditions. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### To verify 1. Set flapping to be disabled in the rule settings 2. Create an alert and set the alert delay to be 2 3. Verify that the alert delay feature delays the alert as expected and the alert actually gets created. (cherry picked from commit 5d2171a)
Contributor
💔 Some backports could not be created
Note: Successful backport PRs will be merged automatically after passing CI. Manual backportTo create the backport manually run: Questions ?Please refer to the Backport tool documentation |
Contributor
Author
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
doakalexi
added a commit
to doakalexi/kibana
that referenced
this pull request
Nov 10, 2025
… when alert delay is set to more than 1 (elastic#242024) Resolves elastic#239852 ## Summary This PR fixes a bug where active alerts aren't created when flapping is disabled and the alert delay feature is used. This bug was happening bc the flapping code created clones of active and recovered alert objects for tracking in the state. When flapping is disabled this code is skipped, so when the active and recovered alerts are deleted from their objects they are also deleted in the objects tracking active and recovered alerts. This PR clones the active and recovered objects before any flapping or alert delay processing to fix this bug. ### Checklist Check the PR satisfies following conditions. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### To verify 1. Set flapping to be disabled in the rule settings 2. Create an alert and set the alert delay to be 2 3. Verify that the alert delay feature delays the alert as expected and the alert actually gets created. (cherry picked from commit 5d2171a)
kibanamachine
added a commit
that referenced
this pull request
Nov 10, 2025
…erated when alert delay is set to more than 1 (#242024) (#242458) # Backport This will backport the following commits from `main` to `9.2`: - [[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)](#242024) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Alexi Doak","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-11-10T17:21:27Z","message":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)\n\nResolves https://github.com/elastic/kibana/issues/239852\n\n## Summary\n\nThis PR fixes a bug where active alerts aren't created when flapping is\ndisabled and the alert delay feature is used. This bug was happening bc\nthe flapping code created clones of active and recovered alert objects\nfor tracking in the state. When flapping is disabled this code is\nskipped, so when the active and recovered alerts are deleted from their\nobjects they are also deleted in the objects tracking active and\nrecovered alerts. This PR clones the active and recovered objects before\nany flapping or alert delay processing to fix this bug.\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### To verify\n\n1. Set flapping to be disabled in the rule settings\n2. Create an alert and set the alert delay to be 2\n3. Verify that the alert delay feature delays the alert as expected and\nthe alert actually gets created.","sha":"5d2171a9e9706a00908d1c7e594b575a6179159f","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","backport:version","v9.1.0","v8.19.0","v9.2.0","v9.3.0"],"title":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1","number":242024,"url":"https://github.com/elastic/kibana/pull/242024","mergeCommit":{"message":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)\n\nResolves https://github.com/elastic/kibana/issues/239852\n\n## Summary\n\nThis PR fixes a bug where active alerts aren't created when flapping is\ndisabled and the alert delay feature is used. This bug was happening bc\nthe flapping code created clones of active and recovered alert objects\nfor tracking in the state. When flapping is disabled this code is\nskipped, so when the active and recovered alerts are deleted from their\nobjects they are also deleted in the objects tracking active and\nrecovered alerts. This PR clones the active and recovered objects before\nany flapping or alert delay processing to fix this bug.\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### To verify\n\n1. Set flapping to be disabled in the rule settings\n2. Create an alert and set the alert delay to be 2\n3. Verify that the alert delay feature delays the alert as expected and\nthe alert actually gets created.","sha":"5d2171a9e9706a00908d1c7e594b575a6179159f"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19","9.2"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.2","label":"v9.2.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/242024","number":242024,"mergeCommit":{"message":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)\n\nResolves https://github.com/elastic/kibana/issues/239852\n\n## Summary\n\nThis PR fixes a bug where active alerts aren't created when flapping is\ndisabled and the alert delay feature is used. This bug was happening bc\nthe flapping code created clones of active and recovered alert objects\nfor tracking in the state. When flapping is disabled this code is\nskipped, so when the active and recovered alerts are deleted from their\nobjects they are also deleted in the objects tracking active and\nrecovered alerts. This PR clones the active and recovered objects before\nany flapping or alert delay processing to fix this bug.\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### To verify\n\n1. Set flapping to be disabled in the rule settings\n2. Create an alert and set the alert delay to be 2\n3. Verify that the alert delay feature delays the alert as expected and\nthe alert actually gets created.","sha":"5d2171a9e9706a00908d1c7e594b575a6179159f"}}]}] BACKPORT--> Co-authored-by: Alexi Doak <[email protected]>
doakalexi
added a commit
that referenced
this pull request
Nov 10, 2025
…nerated when alert delay is set to more than 1 (#242024) (#242461) # Backport This will backport the following commits from `main` to `8.19`: - [[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)](#242024) <!--- Backport version: 10.1.0 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Alexi Doak","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-11-10T17:21:27Z","message":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)\n\nResolves https://github.com/elastic/kibana/issues/239852\n\n## Summary\n\nThis PR fixes a bug where active alerts aren't created when flapping is\ndisabled and the alert delay feature is used. This bug was happening bc\nthe flapping code created clones of active and recovered alert objects\nfor tracking in the state. When flapping is disabled this code is\nskipped, so when the active and recovered alerts are deleted from their\nobjects they are also deleted in the objects tracking active and\nrecovered alerts. This PR clones the active and recovered objects before\nany flapping or alert delay processing to fix this bug.\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### To verify\n\n1. Set flapping to be disabled in the rule settings\n2. Create an alert and set the alert delay to be 2\n3. Verify that the alert delay feature delays the alert as expected and\nthe alert actually gets created.","sha":"5d2171a9e9706a00908d1c7e594b575a6179159f","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","backport:version","v9.1.0","v8.19.0","v9.2.0","v9.3.0"],"title":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1","number":242024,"url":"https://github.com/elastic/kibana/pull/242024","mergeCommit":{"message":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)\n\nResolves https://github.com/elastic/kibana/issues/239852\n\n## Summary\n\nThis PR fixes a bug where active alerts aren't created when flapping is\ndisabled and the alert delay feature is used. This bug was happening bc\nthe flapping code created clones of active and recovered alert objects\nfor tracking in the state. When flapping is disabled this code is\nskipped, so when the active and recovered alerts are deleted from their\nobjects they are also deleted in the objects tracking active and\nrecovered alerts. This PR clones the active and recovered objects before\nany flapping or alert delay processing to fix this bug.\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### To verify\n\n1. Set flapping to be disabled in the rule settings\n2. Create an alert and set the alert delay to be 2\n3. Verify that the alert delay feature delays the alert as expected and\nthe alert actually gets created.","sha":"5d2171a9e9706a00908d1c7e594b575a6179159f"}},"sourceBranch":"main","suggestedTargetBranches":["8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/242457","number":242457,"state":"OPEN"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.2","label":"v9.2.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/242458","number":242458,"state":"OPEN"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/242024","number":242024,"mergeCommit":{"message":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)\n\nResolves https://github.com/elastic/kibana/issues/239852\n\n## Summary\n\nThis PR fixes a bug where active alerts aren't created when flapping is\ndisabled and the alert delay feature is used. This bug was happening bc\nthe flapping code created clones of active and recovered alert objects\nfor tracking in the state. When flapping is disabled this code is\nskipped, so when the active and recovered alerts are deleted from their\nobjects they are also deleted in the objects tracking active and\nrecovered alerts. This PR clones the active and recovered objects before\nany flapping or alert delay processing to fix this bug.\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### To verify\n\n1. Set flapping to be disabled in the rule settings\n2. Create an alert and set the alert delay to be 2\n3. Verify that the alert delay feature delays the alert as expected and\nthe alert actually gets created.","sha":"5d2171a9e9706a00908d1c7e594b575a6179159f"}}]}] BACKPORT-->
kibanamachine
added
v8.19.7
backport missing
Contributor
|
Looks like this PR has backport PRs but they still haven't been merged. Please merge them ASAP to keep the branches relatively in sync. |
doakalexi
added a commit
that referenced
this pull request
Nov 11, 2025
…erated when alert delay is set to more than 1 (#242024) (#242457) # Backport This will backport the following commits from `main` to `9.1`: - [[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)](#242024) <!--- Backport version: 9.6.6 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Alexi Doak","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-11-10T17:21:27Z","message":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)\n\nResolves https://github.com/elastic/kibana/issues/239852\n\n## Summary\n\nThis PR fixes a bug where active alerts aren't created when flapping is\ndisabled and the alert delay feature is used. This bug was happening bc\nthe flapping code created clones of active and recovered alert objects\nfor tracking in the state. When flapping is disabled this code is\nskipped, so when the active and recovered alerts are deleted from their\nobjects they are also deleted in the objects tracking active and\nrecovered alerts. This PR clones the active and recovered objects before\nany flapping or alert delay processing to fix this bug.\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### To verify\n\n1. Set flapping to be disabled in the rule settings\n2. Create an alert and set the alert delay to be 2\n3. Verify that the alert delay feature delays the alert as expected and\nthe alert actually gets created.","sha":"5d2171a9e9706a00908d1c7e594b575a6179159f","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","backport:version","v9.1.0","v8.19.0","v9.2.0","v9.3.0"],"title":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1","number":242024,"url":"https://github.com/elastic/kibana/pull/242024","mergeCommit":{"message":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)\n\nResolves https://github.com/elastic/kibana/issues/239852\n\n## Summary\n\nThis PR fixes a bug where active alerts aren't created when flapping is\ndisabled and the alert delay feature is used. This bug was happening bc\nthe flapping code created clones of active and recovered alert objects\nfor tracking in the state. When flapping is disabled this code is\nskipped, so when the active and recovered alerts are deleted from their\nobjects they are also deleted in the objects tracking active and\nrecovered alerts. This PR clones the active and recovered objects before\nany flapping or alert delay processing to fix this bug.\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### To verify\n\n1. Set flapping to be disabled in the rule settings\n2. Create an alert and set the alert delay to be 2\n3. Verify that the alert delay feature delays the alert as expected and\nthe alert actually gets created.","sha":"5d2171a9e9706a00908d1c7e594b575a6179159f"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19","9.2"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.2","label":"v9.2.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/242024","number":242024,"mergeCommit":{"message":"[Alerting] [Bug] Turning flapping off prevents alerts to be generated when alert delay is set to more than 1 (#242024)\n\nResolves https://github.com/elastic/kibana/issues/239852\n\n## Summary\n\nThis PR fixes a bug where active alerts aren't created when flapping is\ndisabled and the alert delay feature is used. This bug was happening bc\nthe flapping code created clones of active and recovered alert objects\nfor tracking in the state. When flapping is disabled this code is\nskipped, so when the active and recovered alerts are deleted from their\nobjects they are also deleted in the objects tracking active and\nrecovered alerts. This PR clones the active and recovered objects before\nany flapping or alert delay processing to fix this bug.\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\n- [ ] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n\n### To verify\n\n1. Set flapping to be disabled in the rule settings\n2. Create an alert and set the alert delay to be 2\n3. Verify that the alert delay feature delays the alert as expected and\nthe alert actually gets created.","sha":"5d2171a9e9706a00908d1c7e594b575a6179159f"}}]}] BACKPORT--> Co-authored-by: Alexi Doak <[email protected]>
kibanamachine
added
v9.1.7
and removed
backport missing
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves #239852
Summary
This PR fixes a bug where active alerts aren't created when flapping is disabled and the alert delay feature is used. This bug was happening bc the flapping code created clones of active and recovered alert objects for tracking in the state. When flapping is disabled this code is skipped, so when the active and recovered alerts are deleted from their objects they are also deleted in the objects tracking active and recovered alerts. This PR clones the active and recovered objects before any flapping or alert delay processing to fix this bug.
Checklist
Check the PR satisfies following conditions.
To verify