[Observability RAC]: Search a term in the reason field doesn't seem to work

[mgiota]

📝 Summary

When user types in the search bar of the Observability Alerts table a term that is present in the reason field, he should get results that match this term. I was not able to get any results neither by searching for a keyword that was present in the Alerts table nor by searching for the full reason text.

UPDATE: The reason field is indexed as a keyword, which means it is not analyzed, but stored as a single term instead. The expected behavior for this issue would be that querying for the full literal reason message works.

Steps to reproduce

1. Make sure to add following to your kibana configuration

xpack.observability.unsafe.alertingExperience.enabled: true
xpack.ruleRegistry.write.enabled: true

2. Create an Inventory rule type from Metrics App with sensitive threshold data
3. Verify that you get some alerts in the Observability Alerts table

4. In the search bar search for a keyword that was present in the reason field CPU in my example or kibana.alert.reason: "CPU usage is greater than a threshold of 0 (current value is 88%)"

5. No alerts appear

✔️ Acceptance criteria

Searching for the full text that appears in the reason field should display the filtered results in the Observability alerts table.

[weltenwort]

The reason field is indexed as a keyword, which means it is not analyzed, but stored as a single term instead. The expected behavior for that would be that querying for the full literal reason message works.

We can discuss whether it should be analyzed or not, of course.