Otel k8s events added back to kubernetes_otel-cluster-overview Dashboard

[gizas]

• Enhancement

Proposed commit message

• WHAT: Reverting back the events in the Otel General Dashboard of the relevant integration

• WHY: The events mapping was not correct and relavant fields were not available. Latest 8.16.0-SNAPSHOT includes correct mappings. See issue

  • Changed colours of warning/ errors to red pallete
  • Applied filter datastream.dataset: logs-generic-otel to Events
  • For the Latest Events visualsation the Creation Timestampt added, the kind of event and removed the reason

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone repo
• Build package locally elastic-package build
• Create ES elastic-package stack up -d -v --version=8.16.0-SNAPSHOT
• Apply EDOT collector

Related issues

• Closes https://github.com/elastic/opentelemetry-dev/issues/469

Screenshots

[tetianakravchenko]

I've installed this dashboard, few comments:
Viz with title the Occurrences of Warning/Error Events

1. It doesn't make sense to have a breakdown by the object.type - it will be always Warning (since we have filter for the NOT object.type: Normal)
2. instead please use breakdown by kind (Pod/Node) and reason instead:
   
3. Occurrences of Warning/Error Events - please rename, there is no Error type
4. filter can be set to body.structured.object.kind: Event instead of exists to be more specific

Viz Latest Warning/Error Events

1. please rename
2. move kind as a second column
3. instead of using for name body.structured.object.metadata.name, use body.structured.object.regarding.name (is does not include unique id in the end: coredns-7db6d8ff4d-4jnns instead of coredns-7db6d8ff4d-4jnns.1804bc4924e782cf) and maybe rename to the Resource Name
4. add Event Reason to make it easier to correlate with another viz

both vizualisation:

• filtering by the namespace and node is not working

[gizas]

@tetianakravchenko thank you so much for the above. I think all addressed.

One minor the title of body.structured.object.regarding.name made it just Resource (as all other titles consist of one word as well)

[gizas]

filtering by the namespace and node is not working

Events dont have the node info
For the namespace we would need to map : object.regarding.namespace -> resource.attributes.k8s.namespace.name

[tetianakravchenko]

@gizas

One minor the title of body.structured.object.regarding.name made it just Resource (as all other titles consist of one word as well)

As I see you renamed Kind -> Resource, not the Name -> Resource it is intentional, right?

Events dont have the node info

there are 2 kind of events - kind: Pod and kind: Node, Node is hard to reproduce on the 1 node cluster.
I think it is worth testing the table viz for kind: Node - I would expect that namespace field is empty

For the namespace we would need to map : object.regarding.namespace -> resource.attributes.k8s.namespace.name

there are few options: either the mapping (I think we can use alias for that) or the ad-hoc dataview with the script or we just agree on the fact that the filtering is not going to work for the events vizualisations

[gizas]

As I see you renamed Kind -> Resource, not the Name -> Resource it is intentional, right?

Yes. Do you like it? Can we keep it like that?

[tetianakravchenko]

Yes. Do you like it? Can we keep it like that?

Yes, lets keep it this way 👍

[tetianakravchenko]

what is the reason to have timestamp hiden, and created another creation timestamp?

[gizas]

what is the reason to have timestamp hiden, and created another creation timestamp?

Wanted only to show the creation timestamp as I believe is helpful for users. Some times the creation timestamp have the impression can be old and shows an old event.

Timestamp can be deleted I guess

[gizas]

@tetianakravchenko latest update inlcudes the removal of timestamp

For the filtering issue I tried to use a runtime field but seems that they can not replace/update existing fields

So I would say for the time being to merge the PR with no filtering support (cc @MichaelKatsoulis do u agree?)
and I have opened also a PR for the alias here

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: d77842f

History

• 💚 Build #17926 succeeded c314d7d
• 💔 Build #17923 failed 97c0c0f
• 💚 Build #17909 succeeded 2b54f17
• 💚 Build #17863 succeeded e3265a9
• 💚 Build #17727 succeeded 9f751b0

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
99.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package kubernetes_otel - 0.0.6 containing this change is available at https://epr.elastic.co/search?package=kubernetes_otel