Unable to define extra alert information and have free-text search

[mikecote]

It would be nice to provide more information to an alert when creating it and to free-text search that information to find a list of alerts.

In Security's use case, they could add a description, attack technique, and find alerts related to a free-text search.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[pmuellr]

Same for connectors? Something like a description field? I'd say this is actually another candidate for adding to Saved Objects directly, rather than alerts/connectors specifically.

[pmuellr]

Something like the copy_to mapping parameter on the alert params could be a "good enough" fit here. But of course we can't use that, since we're now mapping the params to the flattened mapping type.

Not out of the question that we could do this ourselves. On create/update, take all the alert parameter "leaf" values, concatenate into a single string, add that as a new text field paramsText or such. Perhaps some text analyzer tweaks could be applied, with relevant formatting in the field, to make this more easily searchable.

Not sure if every alert type (and connector type) would need this, so it could be an opt-in via the alert type, to cut down on the space/time requirements this adds.

[mikecote]

I will leave this issue up for discussion until March 9th.