[ResponseOps] Add kibana.alert.time_range field to Alert-As-Data mappings and populate it

[simianhacker]

Summary

This PR adds the field ALERT_TIME_RANGE (aka kibana.alert.time_range) of type data_range to the Alert As Data technical fields. This will allow solutions to draw timelines of alerts on charts by running a date_histogram on the ALERT_TIME_RANGE field. The results is that the date_histogram will create a bucket (with one doc_count per alert) for each bucket that the ALERT_TIME_RANGE field spans. In the example below I have one rule generating 13 alerts which are active for 8 minutes, I then indexed 10 more hosts and the number of alerts jumps to 23.

Ultimately this field will be used for render this chart on Actionable Observability

Caveats

• When visualizing this field with a date_histogram, you MUST set the hard_bounds to the same extents as the range query otherwise the date_histogram will draw every bucket for the entire range. For open ranges OR active alerts in our use case, without the hard_bounds you will end up with a too many buckets exception.

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[elasticmachine]

Pinging @elastic/actionable-observability (Team: Actionable Observability)

[XavierM]

That's just so FANCY!!!

[fkanout]

LGTM

[fkanout]

There is an issue with the field name

[fkanout]

@simianhacke, don't we need to add the new field in the Rule Registry README file?

[maryam-saeidi]

I am also not able to see the field locally, I also don't see any undefined field. Should I see this property for any rule type? I am wondering what I am missing 🤔
@fkanout What were your steps to check the field?

[simianhacker]

@fkanout Because packages/kbn-rule-data-utils changed, you must rebuild the packages. You should be able to do this by running yarn kbn bootstrap and if that doesn't work, run yarn kbn reset && yarn kbn bootstrap.

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: f03d9c7

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/rule-data-utils	71	72	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
observability	523.7KB	523.8KB	+142.0B
securitySolution	6.6MB	6.6MB	+77.0B
triggersActionsUi	665.8KB	666.1KB	+339.0B
total			+558.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
apm	28.9KB	28.9KB	+27.0B
cases	124.6KB	124.6KB	+27.0B
infra	84.6KB	84.6KB	+27.0B
securitySolution	263.7KB	263.8KB	+66.0B
synthetics	24.1KB	24.1KB	+29.0B
timelines	268.7KB	268.8KB	+27.0B
total			+203.0B

Unknown metric groups

API count

id	before	after	diff
@kbn/rule-data-utils	74	75	+1

History

• 💚 Build #77402 succeeded 01ac56b
• 💚 Build #76834 succeeded 7b4d5ed
• 💚 Build #75855 succeeded d6f6880
• 💚 Build #75807 succeeded 0c38682
• 💛 Build #75446 was flaky 7ceb563
• 💔 Build #75068 failed 34d89a8

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[maryam-saeidi]

I tried it locally again with yarn kbn reset && yarn kbn bootstrap and it worked 🎉

I was trying to check the visualization but I didn't find a way to set hard_bounds, @simianhacker how should I do that?

[benakansara]

I tried it locally again with yarn kbn reset && yarn kbn bootstrap and it worked 🎉

I was trying to check the visualization but I didn't find a way to set hard_bounds, @simianhacker how should I do that?

I have the same question as @maryam-saeidi. How to provide hard_bounds in visualization?

[fkanout]

I don't why I had to do yarn kbn reset && yarn kbn bootstrap twice until I saw the time_range field.

LGTM

[fkanout]

@fkanout What were your steps to check the field?

@maryam-saeidi, as Chris said yarn kbn reset && yarn kbn bootstrap, then you need a freshly created rule OR a new active alert

[ogupte]

LGTM for APM

[simianhacker]

@maryam-saeidi @benakansara Lens date histogram only works with date_range fields that have a start (gte) and end (lte). When I did that original visualization, I was setting both. The solution we settled on is to leave the ranges open for active alerts and then ensure that hard_bounds is set when we query the data for our solutions (via the API that @XavierM is developing for us). I'll file an issue with the @elastic/kibana-vis-editors team to have them use hard_bounds instead of in addition to extended_bounds for date_range fields.