rules: cleanup saved objects mappings

[TinaHeiligers]

Summary

Related to #149102

Subset of the global cleanup attempt in #153070

Dry run for cleaning up rules mappings

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

[TinaHeiligers]

@elastic/response-ops f CI goes green, we can use this PR to clean up the mappings.
If not, it means there's a direct reference to the fields. Could you please review these fields and update the mapping accordingly?

[TinaHeiligers]

@elasticmachine merge upstream

[kibanamachine]

merge conflict between base and head

[TinaHeiligers]

@elasticmachine merge upstream

[TinaHeiligers]

@elasticmachine merge upstream

[TinaHeiligers]

@elasticmachine merge upstream

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 3b318f7

Failed CI Steps

• FTR Configs #3
• APM Cypress Tests #4

Metrics [docs]

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/saved-objects-service.html#_mappings

id	before	after	diff
alert	101	97	-4
rules-settings	9	-	-9
total			-13

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
securitySolution	433	436	+3

Total ESLint disabled count

id	before	after	diff
securitySolution	513	516	+3

History

• 💔 Build #115525 failed 13cb2ca
• 💛 Build #115020 was flaky fa6294a
• 💔 Build #114360 failed 2202dd3
• 💔 Build #113786 failed 00fae82
• 💔 Build #113774 failed eca7f5c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/apm-ui (Team:APM)

[yngrdyn]

APM changes LGTM

[pmuellr]

note, there are also alerting SO mapping cleanups in PR #152857 cc: @XavierM

Guessing we'll want the #152857 version for alerting, and not this in this PR.

[TinaHeiligers]

Guessing we'll want the #152857 version for alerting, and not this in this PR.

@pmuellr are you talking about the changes to the mappings I made here in the alerting plugin? Should I revert those?

[pmuellr]

are you talking about the changes to the mappings I made here in the alerting plugin? Should I revert those?

I honestly don't know, but @XavierM will. I just happened to notice this PR with SO mapping changes to alerting SO's, and knew that Xavier has also been doing some of this ...

[TinaHeiligers]

Xavier has also been doing some of this

@XavierM Please let me know if you'd prefer to handle the mapping changes for alerting or if you'd like me to merge this PR to help you out.

[TinaHeiligers]

The mapping changes for alerting are to be handled in #152857 and the only change here to the mappings for apm is a code comment. As such, this PR is not needed.