Editing existing trigger always set trigger condition to 10000 events instead last saved value

[cichons]

When i enter on edit trigger page, the trigger condition is always set to 10000 instead to last saved condition value

Opendistro version :
opendistroforelasticsearch-kibana-1.10.1-1.x86_64
opendistro-alerting-1.10.1.2-1.noarch

[LukaszWasko]

+1

[lezzago]

Hi @cichons and @LukaszWasko,

I tried to reproduce the issue, but I was not able to. The trigger is displaying the last saved value for me. I have a few questions:

1. Did you upgrade your opendistro version from another version? If so, may you please let me know from which version?
2. Can you post the JSON of your monitor (from the GET monitor/{id} API) so I can take a look (don't forget to scrub any data from the JSON!).

Thanks,
Ashish

[cichons]

I use Opendistro from 1.7.0-1 version updated to 1.8.0 updated to 1.9.0 updated to 1.10.1 and currently lasted version 1.11

monitor dump : GET _opendistro/_alerting/monitors/ZVrICXMBJ-xhvuTI0rM7
`
{ -
"_id": "ZVrICXMBJ-xhvuTI0rM7",
"_version": 34,
"_seq_no": 86,
"_primary_term": 14,
"monitor": { -
"type": "monitor",
"schema_version": 3,
"name": "5xx",
"user": { -
"name": "Cichon, Slawomir",
"backend_roles": [ -

  ],
  "roles": [ - 
    "all_access"
  ],
  "custom_attribute_names": [ - 
    
  ]
},
"enabled": true,
"enabled_time": 1596792584337,
"schedule": { - 
  "period": { - 
    "interval": 1,
    "unit": "MINUTES"
  }
},
"inputs": [ - 
  { - 
    "search": { - 
      "indices": [ - 
        "access_log"
      ],
      "query": { - 
        "size": 0,
        "query": { - 
          "bool": { - 
            "filter": [ - 
              { - 
                "range": { - 
                  "@timestamp": { - 
                    "from": "{{period_end}}||-2m",
                    "to": "{{period_end}}",
                    "include_lower": true,
                    "include_upper": true,
                    "format": "epoch_millis",
                    "boost": 1
                  }
                }
              },
              { - 
                "term": { - 
                  "resp.code": { - 
                    "value": 500,
                    "boost": 1
                  }
                }
              }
            ],
            "adjust_pure_negative": true,
            "boost": 1
          }
        },
        "aggregations": { - 

        }
      }
    }
  }
],
"triggers": [ - 
  { - 
    "id": "Z1rpCXMBJ-xhvuTI6bO4",
    "name": "http_500",
    "severity": "2",
    "condition": { - 
      "script": { - 
        "source": "ctx.results[0].hits.total.value > 5000",
        "lang": "painless"
      }
    },
    "actions": [ - 
      { - 
        "id": "aFrpCXMBJ-xhvuTI6bO4",
        "name": "icinga",
        "destination_id": "ZlroCXMBJ-xhvuTISrPA",
        "message_template": { - 
          "source": "{ \n\"Monitor\":\"{{ctx.monitor.name}}\", \n\"Trigger\":\"{{ctx.trigger.name}}\", \n\"period_start\":\"{{ctx.periodStart}}\", \n\"period_end\":\"{{ctx.periodEnd}}\", \n\"Severity\":\"{{ctx.trigger.severity}}\", \n\"message\":\"Error rate is {{ctx.results.0.hits.total.value}} limit is set to LIMIT\" \n} ",
          "lang": "mustache"
        },
        "throttle_enabled": false,
        "subject_template": { - 
          "source": "",
          "lang": "mustache"
        }
      }
    ]
  }
],
"last_update_time": 1604560969313

}
}
`

[Yeading]

I met this issue too,7.10.0

[kid4git]

I can confirm the issue on [email protected] and found two ways to reproduce:

a) The first circumstance under which this happens is if the trigger name contains a dot ("."). So a name like "Trigger without a dot" works fine, but "Trigger with a ." always makes the trigger condition to be set to 10.000 and the operator to "is above" instead of the previously set config when I open a trigger for editing.

I could not reproduce the bug with other characters. E.g. underscores like in "trigger_name" in the OP's screenshot work fine for me. Just the dot causes the issue.

b) The second way to reproduce this bug is to open the monitor for editing, then click the "update" button. Now if I open the trigger for editing, the condition's value is displayed as 10.000, even if the trigger name doesn't contain a dot. After correcting the value and saving the trigger (without a dot in the name), the value is displayed correctly when editing the trigger the next time.

In both cases, the originally saved value is correctly kept in monitor data, it's just displayed incorrectly. However, saving that incorrectly displayed value will change it permanently.