[alerts] expose API to generate alert instance summary from event log documents

[pmuellr]

It's not clear that this will be needed, but thought I'd create an issue to outline how it might work, if it is.

For the "Alert Details" page, we generate the list of instances and data from them, via this function, which is not currently exposed as an API:

kibana/x-pack/plugins/alerts/server/lib/alert_instance_summary_from_event_log.ts

Lines 11 to 20 in da8abda

	export interface AlertInstanceSummaryFromEventLogParams {
	alert: SanitizedAlert<{ bar: boolean }>;
	events: IEvent[];
	dateStart: string;
	dateEnd: string;
	}
	export function alertInstanceSummaryFromEventLog(
	params: AlertInstanceSummaryFromEventLogParams
	): AlertInstanceSummary {

As we are getting more consumers of the event log coming on line, this function - or similar ones, or perhaps this one with more parameters/capabilities - could be useful if we only end up providing a way to get ALL the event log docs (eg, if we don't support a richer search mechanism). Otherwise, those consumers will be forced to implement similar logic in their own plugins.

We'd need to clean this up a bit to turn it into an API, and presumably if we did this, we'd also change it to support events from multiple alerts, and not just a single alert. And presumably, it would be a function on the alertsClient.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[mikecote]

@YulNaumenko, you mentioned this is necessary to allow listing active instances across different alerts?

[YulNaumenko]

It would be nice to have an option to select only active instances here, so probably this API should include the filtering. Maybe implementing this issue could solve the problem.

[YulNaumenko]

In addition, we definitely want to have a support for a multiple alerts instance summary, something like:

export interface AlertInstanceSummaryFromEventLogParams { 
   alerts: SanitizedAlert<{ bar: boolean }>[]; 
   events: IEvent[]; 
   dateStart: string; 
   dateEnd: string; 
 } 

[pmuellr]

Closed, as this is more or less just a thought, and more relevant to issue: #70169 - moved the body of the summary to a new comment in that issue.