@fkanout
With @XavierM we found a way to use the nested "avg" aggregations suggested by @simianhacker

{
  "index": ".alerts-observability.apm.alerts-*",
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "kibana.alert.rule.uuid": "aa081910-969e-11ed-adcb-b1469b179bd9"
          }
        },
        {
          "range": {
            "kibana.alert.time_range": { "gte": "now-30d", "lt": "now" }
          }
        }
      ]
    }
  },
  "aggs": {
    "histogramTriggeredAlerts": {
      "date_histogram": {
        "field": "kibana.alert.start",
        "fixed_interval": "1d",
        "extended_bounds": { "min": "now-30d", "max": "now" }
      }
    },
    "avgTimeToRecoverMSE": {
      "filter": {
        "term": {
          "kibana.alert.status": "recovered"
        }
      },
      "aggs": {
        "recoveryTime": {
          "avg": {
            "field": "kibana.alert.duration.us"
          }
        }
      }
    }
  }
}

And for this, you need to change the x-pack/plugins/rule_registry/common/types.ts using this:

export const bucketAggsSchemas = t.intersection([
  bucketAggsTempsSchemas,
  t.exact(
    t.partial({
      aggs: t.record(t.string, t.intersection([metricsAggsSchemas, bucketAggsTempsSchemas])),
      aggregations: t.record(
        t.string,
        t.intersection([metricsAggsSchemas, bucketAggsTempsSchemas])
      ),
    })
  ),
]);

Basically, we cannot use and allow script from the API because it bypass any security measure in place. And would allow, technically, anyone to access any alerts stored (from @XavierM). Also, the signature comments for MetricAggs in the types.ts file have been misplaced.

💚 Build Succeeded

• Buildkite Build
• Commit: 67ec170
• Storybooks Preview

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

History

• 💔 Build #101523 failed f852882
• 💔 Build #101378 failed b8d79d9
• 💔 Build #101306 failed ef6d66d
• 💔 Build #101077 failed c1a5647
• 💚 Build #100755 succeeded 2412cf4
• 💔 Build #100691 failed 9989f48

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @fkanout