[RAC][Rule Registry] UI/UX around timeouts and errors during index bootstrapping

[banderror]

Parent ticket: #101016

Summary

Background: #108115 (comment)

During index bootstrapping there can occur certain situations related to network conditions:

• Timeouts, for example when network or ES cluster are under load. Currently we have 20 minutes timeout for installing common ES resources shared between all indices + 20 minutes timeout for installing index-specific resources for each index separately (e.g. for .alerts-security.alerts). Total 40 minutes.

  • During these 20-40 minutes the rules will be blocked on attempting to write alerts and will be hanging. It will look like "going to run" status in the Rule Management table in Security and no logs or other messages.

• Errors, like network errors or errors from Elasticsearch.

  • In this case, errors will be re-thrown as exceptions; the rule status will change to "failed" and there will be some Kibana logs available.

Do we need to build a better UX around that?

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[banderror]

Hey everyone, FYI ownership of this ticket and other tickets related to rule_registry (like #101016) now goes to the Detection Alerts area (Team:Detection Alerts label). Please ping @peluja1012 and @marshallmain if you have any questions.

[marshallmain]

Transferring again to @elastic/response-ops as they now own the rule registry implementation.