Adding ALERT_CONTEXT to Metric Threshold Rule AAD documents

[simianhacker]

Summary

This PR serializes the "action context" into ALERT_CONTEXT and stores it in the Alert-As-Data index. This will be used by the "alert detail page" to display group by details along with other information from the alert context.

Fixes #155534
Fixes #154126

[apmmachine]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[simianhacker]

Fixes #155534

[elasticmachine]

Pinging @elastic/actionable-observability (Team: Actionable Observability)

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 4181c8f

Metrics [docs]

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
enterpriseSearch	19	21	+2
securitySolution	400	404	+4
total			+6

Total ESLint disabled count

id	before	after	diff
enterpriseSearch	20	22	+2
securitySolution	480	484	+4
total			+6

History

• 💔 Build #127910 failed 3c2101a

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[XavierM]

I just wanted to let you know that we already added an attributes for alert detail URL kibana.alert.url, I am wondering if we can build this context when you ask for an alert and use as much possible the ECS. Maybe I am not seeing the full picture here.

[kobelb]

I just wanted to let you know that we already added an attributes for alert detail URL kibana.alert.url, I am wondering if we can build this context when you ask for an alert and use as much possible the ECS. Maybe I am not seeing the full picture here.

++ to Xavier's recommendation. I don't think that we should be putting the entire action context into the alert as it duplicates a lot of the information that we already have in the alert in different fields. I'd prefer we add additional fields to the alert to allow us to recreate the "context" in the flyout.

If you feel strongly that the benefits we get from this approach outweigh the drawbacks, can we rename kibana.alert.context to kibana.alert.observability.context to make it explicit that this field is only relevant to observability alerts?

[simianhacker]

This is a follow up to this PR: #155327

[mohamedhamed-ahmed]

LGTM!

[simianhacker]

We've decided to go a different direction