It is too cumbersome to index an active alert instance "as-is" into a document in Elasticsearch

[gmmorris]

Related to #88957 (comment)

Describe the feature:
We'd like to make it possible to index the raw Alert Instance using an Index Connector.

Describe a specific use case for the feature:
This is a quick win in order to make it easier to store alerts as data which users can interact with using Discover & Dashboards.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[pmuellr]

Is the intention to provide a checkbox like in your POC? Or somehow make it easier for a customer to "manually" do this?

proceeding down the "manually" doing it path ...

I think in theory you can capture all the "alert variables" that action templates can use with {{.}}, however when rendered, this will end up rendering as [object Object]. The trick we did to make all the nested JSON objects expand to their JSON representation doesn't apply to the top-level object - but we could probably fix this. Mean time, we could hard-code all the top-level properties, and then add the context via { ... , "context": {{context}} }.

So, let's say it's easy for a customer to create an index action with the documents body being {{.}}, which would expand to the full JSON. I think our JSON editing for that action prevents us from actually doing that, since it won't be legal JSON. At some point we have to fix that anyway.

Dumping the variables as the document via {{.}} implies each alert would have to be a different index. Alternatively, we could say you have to do { indexThreshold: {{.}} } to get the alert type in as a top-level property, to allow multiple alert types to use the same index.

Then we need mappings and an index template.

All of this seems programmable, except for the mappings part, which we'd need to keep updated as the contexts change. Presumably a function test would indicate some mapping-related failures, if we add a test of this per-type, but maybe there's some that would sneak through.

[mikecote]

We should timebox this to 3 days max.