Hey everyone, I've been wrestling with our ES notables dashboard for a while—anyone else feel like it becomes a graveyard for old, low-priority items? We had a ton of informational alerts just sitting there from months ago, cluttering the view for analysts.
I finally built a simple automated workflow that closes any notable event after 30 days of no status change (like from "New" or "In Progress"). It runs as a scheduled search and has really cleaned up our operational view. Here's the basic logic:
* Scheduled search runs daily, looking for notables older than 30 days where the last status update was also more than 30 days ago.
* It updates those records to status "Closed" and sets the closure reason to "Automatically closed due to inactivity."
* I added an extra filter to exclude any with a high priority label, just to be safe.
The key was using the `status_updated` field in the `notable` lookup. The actual action is just a simple `| outputlookup` append back to that lookup. It's been running for a couple months now with zero fuss. It doesn't delete the events, just changes their status, so all the data is still there for audits.
This might seem obvious to some, but it's made a huge difference for our team's focus. Has anyone else set up similar housekeeping rules? I'm curious if you're filtering on other fields or using a different time window for certain types of notables.
Billy
Always A/B test.