[ResponseOps] examples in docs referencing deprecated context variables

[pmuellr]

A customer noted that some of the examples in our docs use deprecated context variables. Actually, these aren't even documented - I think we deprecated in 7.x and then removed the doc in 8.x or something. We actually do still set the variables, for existing old rules, but would like customers to use the documented ones.

The examples noted were using {{alertName}}, but should be using {{rule.name}}:

• https://www.elastic.co/guide/en/kibana/8.8/create-rule-api.html#create-rule-api-example
• https://www.elastic.co/guide/en/kibana/current/create-and-manage-rules.html#defining-rules-actions-details

We should check other docs that include action parameter templates for other deprecated/not-documented variables.

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[pmuellr]

cc: @lcawl

[lcawl]

Relates to elastic/security-docs#3498, #161126

[lcawl]

The following pages require updates:

• https://github.com/elastic/kibana/blob/main/docs/api/alerting/create_rule.asciidoc [DOCS] Remove deprecated action variables from rule APIs #161216
• https://github.com/elastic/kibana/blob/main/docs/api/alerting/get_rules.asciidoc [DOCS] Remove deprecated action variables from rule APIs #161216
• https://github.com/elastic/kibana/blob/main/docs/api/alerting/legacy/create.asciidoc [DOCS] Remove deprecated action variables from rule APIs #161216
• https://github.com/elastic/kibana/blob/main/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_request.yaml [DOCS] Remove deprecated action variables from rule APIs #161216
• https://github.com/elastic/kibana/blob/main/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_response.yaml [DOCS] Remove deprecated action variables from rule APIs #161216
• https://github.com/elastic/kibana/blob/main/x-pack/plugins/alerting/docs/openapi/components/examples/find_rules_response.yaml [DOCS] Remove deprecated action variables from rule APIs #161216
• https://github.com/elastic/kibana/blob/main/x-pack/plugins/alerting/docs/openapi/components/examples/get_rule_response.yaml [DOCS] Remove deprecated action variables from rule APIs #161216
• https://github.com/elastic/kibana/blob/main/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_request.yaml [DOCS] Remove deprecated action variables from rule APIs #161216
• https://github.com/elastic/kibana/blob/main/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_response.yaml [DOCS] Remove deprecated action variables from rule APIs #161216
• https://github.com/elastic/kibana/blob/main/docs/user/alerting/action-variables.asciidoc [DOCS] Add rule.params to rule action variables #161714
• https://github.com/elastic/kibana/blob/main/x-pack/test/screenshot_creation/apps/response_ops_docs/stack_connectors/connector_types.ts N/A

Screenshots will likely also be affected in pages like these (after #161136 is merged):

• https://www.elastic.co/guide/en/kibana/current/rule-type-index-threshold.html#_example [DOCS] Refresh rule action variable screenshots #162098
• https://www.elastic.co/guide/en/observability/current/infrastructure-threshold-alert.html [DOCS] Refresh screenshots with deprecated rule action variables observability-docs#3085
• https://www.elastic.co/guide/en/observability/current/metrics-threshold-alert.html [DOCS] Refresh screenshots with deprecated rule action variables observability-docs#3085

If the deprecated variables are removed from the preconfigured index connector, the screenshot on this page will be affected:

• https://github.com/elastic/kibana/blob/main/docs/management/connectors/action-types/index.asciidoc [DOCS] Refresh rule action variable screenshots #162098

[pmuellr]

Ya, looks like most of these are using {{alertName}} which should be replaced with {{rule.name}}.

There are also a few references in actual code, but seems like mainly tests, for example:

kibana/x-pack/plugins/alerting/server/saved_objects/migrations/index.test.ts

Lines 2844 to 2861 in e9a9f03

	describe('Metrics Inventory Threshold rule', () => {
	test('Migrates incorrect action group spelling', () => {
	const migration800 = SavedObjectsUtils.getMigrationFunction(
	getMigrations(encryptedSavedObjectsSetup, {}, isPreconfigured)['8.0.0']
	);
	const actions = [
	{
	group: 'metrics.invenotry_threshold.fired',
	params: {
	level: 'info',
	message:
	'""{{alertName}} - {{context.group}} is in a state of {{context.alertState}} Reason: {{context.reason}}""',
	},
	actionRef: 'action_0',
	actionTypeId: '.server-log',
	},
	];

Feels like we should remove them everywhere, except where we are setting and testing for the valid uses (since we will likely always have to support these), so keep the surface area smaller, in hopes they don't get copied around more.

[lcawl]

I've also created #161710, since I was investigating adding rule.params to https://www.elastic.co/guide/en/kibana/master/rule-action-variables.html and noticed some were missing descriptions in the UI.