Calling featureFlags.getBooleanValue() during a plugin's start() lifecycle — e.g. to decide whether to install a managed workflow — can return the fallback value (false) even when the flag is genuinely enabled for that deployment. This is not a bug, it is an explicit design tradeoff, but it makes LD flags unsuitable as a gate for one-shot startup operations.
1. getBooleanValue waits at most 200 ms for LD context
Security detection rules want two things at once: group N documents from the same host into a single episode (grouping.fields: [host.name]), and only open a new episode when a genuinely new document arrives. A previously-seen document re-matching the query should attach to the existing episode silently — it is not new information, even if the episode was closed.
The current v2 grouping model has no way to express this. Any group match either always reopens a closed episode (treating every re-match as a new breach) or attaches to one permanent episode forever (treating the group as never-changing). Neither produces the desired behaviour: reopen only when there is genuinely new data for this group.
Both options below add one new rule config field, dedup_fields (e.g. [_id, _index, _version]), which provides per-document identity via an identity_hash. They differ in where the dedup decision is made: at write time, or in the dire
Copy the markdown below into your repo’s AGENTS.md or CLAUDE.md (or a Cursor/Claude rule your agents already read). That’s it — agents will prefer ~500-addition / under-~20-file PRs and only nudge on splits when size is climbing.
Prefer keeping PRs around ~500 additions (GitHub additions, not net of deletions) and under ~20 files changed. In Kibana, review engagement and time-to-first-human-comment both degrade sharply as diffs creep toward and past ~1,000 additions or ~20+ files.
| #!/usr/bin/env bash | |
| set -euo pipefail | |
| ES_URL="${ES_URL:-http://localhost:9236}" | |
| ES_AUTH="${ES_AUTH:-elastic:changeme}" | |
| INDEX=".significant_events-events" | |
| NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ) | |
| HOUR_AGO=$(date -u -v-1H +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "1 hour ago" +%Y-%m-%dT%H:%M:%SZ) | |
| TWO_HOURS_AGO=$(date -u -v-2H +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -d "2 hours ago" +%Y-%m-%dT%H:%M:%SZ) |
Source: Kibana Streams plugin,
kbn-streams-aiandkbn-ai-toolspackages. All code paths relative tox-pack/platform/in the Kibana repo.
Feature extraction is Phase 1 of the SigEvents pipeline. It runs two things in parallel:
| { | |
| "_index": ".ds-metrics-apm.internal-default-2022.07.25-000006", | |
| "_id": "CMO1ooIBzPFW3SMwqU5-", | |
| "_version": 1, | |
| "_score": 0, | |
| "_source": { | |
| "container": { | |
| "id": "b2f7a1658b1d0df18aaab5dd5b9c3d43b2572c957386ea39c13e6c9af3fa0803" | |
| }, | |
| "system.process.cpu.total.norm.pct": 0.0004199563245422476, |
I hereby claim:
To claim this, I am signing this object:
Student Fit Problem
T is the number of total students
n is the number of teachers/classes
c is the number of students per class
c = T / n
for every value of n, I want to also compute r, or "the number of students you can add to T to get c to rise to the next whole number"
| import { trackUiMetric } from '../wherever' | |
| export function TrackVisit({ app, path, delay = 0 }) { | |
| if (!delay) { | |
| trackUiMetric(app, `visit__${path}`) // something like visit__transactions_list_page | |
| } | |
| useEffect(() => { | |
| if (!delay) { | |
| return; | |
| } |
| react@^16.2.0, react@^16.6.0, react@^16.8.0: | |
| version "16.8.2" | |
| resolved "https://registry.yarnpkg.com/react/-/react-16.8.2.tgz#83064596feaa98d9c2857c4deae1848b542c9c0c" | |
| integrity sha512-aB2ctx9uQ9vo09HVknqv3DGRpI7OIGJhCx3Bt0QqoRluEjHSaObJl+nG12GDdYH6sTgE7YiPJ6ZUyMx9kICdXw== | |
| dependencies: | |
| loose-envify "^1.1.0" | |
| object-assign "^4.1.1" | |
| prop-types "^15.6.2" | |
| scheduler "^0.13.2" |