Improve system test coverage for all inputs - 2

packages/blacklens/data_stream/alerts/_dev/deploy/docker/docker-compose.yml

@@ -0,0 +1,15 @@
+version: '2.3'
+services:
+  blacklens:
+    image: docker.elastic.co/observability/stream:v0.20.0
+    hostname: blacklens
+    ports:
+      - 8090
+    volumes:
+      - ./files:/files:ro
+    environment:
+      PORT: '8090'
+    command:
+      - http-server
+      - --addr=:8090
+      - --config=/files/config.yml

packages/blacklens/data_stream/alerts/_dev/deploy/docker/files/config.yml

@@ -0,0 +1,111 @@
+rules:
+  - path: /api/v1/test_ws_id/alert
+    methods: [GET]
+    query_params:
+      page: 2
+      per_page: 50
+      sort_by: created_date
+      sort: asc
+    responses:
+      - status_code: 200
+        body: |-
+          {{ minify_json `
+          {
+            "results": [
+              {
+                "updated_date": "2024-11-12T09:39:58.489Z",
+                "created_date": "2024-11-12T09:39:58.489Z",
+                "id": 1003,
+                "details": {
+                  "id": 100,
+                  "engine": "Port Scanner",
+                  "title": "New Open Port"
+                },
+                "severity": "medium",
+                "affected_entities": 2,
+                "alert_outcome": "affected",
+                "alert_status": "resolved",
+                "customer_state": "open",
+                "alert_payload": [],
+                "type_id": 100
+              }
+            ],
+            "pagination": {
+              "next": "page3",
+              "page": "2"
+            }
+          }
+          `}}
+  - path: /api/v1/test_ws_id/alert
+    methods: [GET]
+    query_params:
+      page: 3
+      per_page: 50
+      sort_by: created_date
+      sort: asc
+    responses:
+      - status_code: 200
+        body: |-
+          {{ minify_json `
+          {
+            "results": [
+              {
+                "updated_date": "2024-11-12T09:39:58.489Z",
+                "created_date": "2024-11-12T09:39:58.489Z",
+                "id": 1002,
+                "details": {
+                  "id": 100,
+                  "engine": "Port Scanner",
+                  "title": "New Open Port"
+                },
+                "severity": "medium",
+                "affected_entities": 2,
+                "alert_outcome": "affected",
+                "alert_status": "resolved",
+                "customer_state": "open",
+                "alert_payload": [],
+                "type_id": 100
+              }
+            ],
+            "pagination": {
+              "next": "",
+              "page": "3"
+            }
+          }
+          `}}
+  - path: /api/v1/test_ws_id/alert
+    methods: [GET]
+    query_params:
+      per_page: 50
+      sort_by: created_date
+      sort: asc
+    responses:
+      - status_code: 200
+        body: |-
+          {{ minify_json `
+          {
+            "results": [
+              {
+                "updated_date": "2024-11-12T09:39:58.489Z",
+                "created_date": "2024-11-12T09:39:58.489Z",
+                "id": 1001,
+                "details": {
+                  "id": 100,
+                  "engine": "Port Scanner",
+                  "title": "New Open Port"
+                },
+                "severity": "medium",
+                "affected_entities": 2,
+                "alert_outcome": "affected",
+                "alert_status": "resolved",
+                "customer_state": "open",
+                "alert_payload": [],
+                "type_id": 100
+              }
+            ],
+            "pagination": {
+              "next": "page2",
+              "page": "1"
+            }
+          }
+          `}}

packages/blacklens/data_stream/alerts/_dev/test/system/test-httpjson-config.yml

@@ -0,0 +1,10 @@
+input: httpjson
+service: blacklens
+vars:
+  url: http://{{Hostname}}:{{Port}}
+  tenant_id: test_tenant_id
+  ws_id: test_ws_id
+  api_key: test_api_key
+  request.tracer: true
+assert:
+  hit_count: 3

packages/blacklens/data_stream/alerts/sample_event.json

@@ -1,61 +1,55 @@
 {
-    "input": {
-        "type": "httpjson"
-    },
+    "@timestamp": "2024-11-12T09:39:58.489Z",
     "agent": {
-        "name": "example-agent",
-        "id": "example-agent-id-12345",
+        "ephemeral_id": "33939e93-54ef-4184-b92b-bc8f02e179a6",
+        "id": "f98f4444-6fca-4500-83b6-a8c5e8f32bf1",
+        "name": "elastic-agent-49577",
         "type": "filebeat",
-        "ephemeral_id": "ephemeral-id-12345",
         "version": "8.15.2"
     },
-    "@timestamp": "2024-11-07T08:09:22.094Z",
-    "ecs": {
-        "version": "8.11.0"
+    "blacklens": {
+        "alert": {
+            "id": 1001,
+            "outcome": "affected",
+            "severity": "medium",
+            "status": "resolved",
+            "title": "New Open Port",
+            "type": "Port Scanner",
+            "type_id": 100,
+            "updated_date": "2024-11-12T09:39:58.489Z"
+        }
     },
     "data_stream": {
-        "namespace": "default",
-        "type": "logs",
-        "dataset": "blacklens.alerts"
+        "dataset": "blacklens.alerts",
+        "namespace": "41265",
+        "type": "logs"
     },
-    "elastic_agent": {
-        "id": "example-agent-id-12345",
-        "version": "8.15.2",
-        "snapshot": false
-    },
-    "host": {
-        "name": "example-host"
+    "ecs": {
+        "version": "8.11.0"
     },
-    "blacklens": {
-        "alert": {
-            "severity": "info",
-            "type_id": 1001,
-            "details": [],
-            "updated_date": "2024-08-14T15:06:13.151Z",
-            "id": 12345,
-            "type": "Example Threat System (ETS)",
-            "title": "Example Threat Scan Notification",
-            "outcome": "undefined",
-            "status": "resolved"
-        }
+    "elastic_agent": {
+        "id": "f98f4444-6fca-4500-83b6-a8c5e8f32bf1",
+        "snapshot": false,
+        "version": "8.15.2"
     },
-    "message": "{\"affected_entities\":null,\"alert_outcome\":\"undefined\",\"alert_payload\":[],\"reference\":\"https://example.com/reference123\"}],\"alert_status\":\"resolved\",\"created_date\":\"2024-11-07T08:09:22.094028Z\",\"customer_state\":\"open\",\"details\":{\"engine\":\"Example Threat System (ETS)\",\"id\":1001,\"title\":\"Example Threat Scan Notification\"},\"id\":12345,\"severity\":\"info\",\"type_id\":1001,\"updated_date\":\"2024-08-14T15:06:13.151728Z\"}",
     "event": {
-        "id": 12345,
         "agent_id_status": "verified",
-        "ingested": "2024-11-07T09:45:30Z",
-        "created": "2024-11-07T09:45:29.354Z",
-        "kind": "alert",
         "category": [
             "threat"
         ],
+        "created": "2025-12-09T05:45:05.855Z",
+        "dataset": "blacklens.alerts",
+        "id": "1001",
+        "ingested": "2025-12-09T05:45:08Z",
         "type": [
             "indicator"
-        ],
-        "dataset": "blacklens.alerts"
+        ]
+    },
+    "input": {
+        "type": "httpjson"
     },
     "tags": [
         "forwarded",
-        "example-alert"
+        "blacklens-alert"
     ]
-}
+}

packages/blacklens/docs/README.md

@@ -54,64 +54,58 @@ An example event for `alerts` looks as following:
 
 ```json
 {
-    "input": {
-        "type": "httpjson"
-    },
+    "@timestamp": "2024-11-12T09:39:58.489Z",
     "agent": {
-        "name": "example-agent",
-        "id": "example-agent-id-12345",
+        "ephemeral_id": "33939e93-54ef-4184-b92b-bc8f02e179a6",
+        "id": "f98f4444-6fca-4500-83b6-a8c5e8f32bf1",
+        "name": "elastic-agent-49577",
         "type": "filebeat",
-        "ephemeral_id": "ephemeral-id-12345",
         "version": "8.15.2"
     },
-    "@timestamp": "2024-11-07T08:09:22.094Z",
-    "ecs": {
-        "version": "8.11.0"
+    "blacklens": {
+        "alert": {
+            "id": 1001,
+            "outcome": "affected",
+            "severity": "medium",
+            "status": "resolved",
+            "title": "New Open Port",
+            "type": "Port Scanner",
+            "type_id": 100,
+            "updated_date": "2024-11-12T09:39:58.489Z"
+        }
     },
     "data_stream": {
-        "namespace": "default",
-        "type": "logs",
-        "dataset": "blacklens.alerts"
+        "dataset": "blacklens.alerts",
+        "namespace": "41265",
+        "type": "logs"
     },
-    "elastic_agent": {
-        "id": "example-agent-id-12345",
-        "version": "8.15.2",
-        "snapshot": false
-    },
-    "host": {
-        "name": "example-host"
+    "ecs": {
+        "version": "8.11.0"
     },
-    "blacklens": {
-        "alert": {
-            "severity": "info",
-            "type_id": 1001,
-            "details": [],
-            "updated_date": "2024-08-14T15:06:13.151Z",
-            "id": 12345,
-            "type": "Example Threat System (ETS)",
-            "title": "Example Threat Scan Notification",
-            "outcome": "undefined",
-            "status": "resolved"
-        }
+    "elastic_agent": {
+        "id": "f98f4444-6fca-4500-83b6-a8c5e8f32bf1",
+        "snapshot": false,
+        "version": "8.15.2"
     },
-    "message": "{\"affected_entities\":null,\"alert_outcome\":\"undefined\",\"alert_payload\":[],\"reference\":\"https://example.com/reference123\"}],\"alert_status\":\"resolved\",\"created_date\":\"2024-11-07T08:09:22.094028Z\",\"customer_state\":\"open\",\"details\":{\"engine\":\"Example Threat System (ETS)\",\"id\":1001,\"title\":\"Example Threat Scan Notification\"},\"id\":12345,\"severity\":\"info\",\"type_id\":1001,\"updated_date\":\"2024-08-14T15:06:13.151728Z\"}",
     "event": {
-        "id": 12345,
         "agent_id_status": "verified",
-        "ingested": "2024-11-07T09:45:30Z",
-        "created": "2024-11-07T09:45:29.354Z",
-        "kind": "alert",
         "category": [
             "threat"
         ],
+        "created": "2025-12-09T05:45:05.855Z",
+        "dataset": "blacklens.alerts",
+        "id": "1001",
+        "ingested": "2025-12-09T05:45:08Z",
         "type": [
             "indicator"
-        ],
-        "dataset": "blacklens.alerts"
+        ]
+    },
+    "input": {
+        "type": "httpjson"
     },
     "tags": [
         "forwarded",
-        "example-alert"
+        "blacklens-alert"
     ]
 }
 ```