Onboard "Custom Threshold" rule type with FAAD

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/custom_threshold_executor.ts

@@ -8,7 +8,6 @@
 import { isEqual } from 'lodash';
 import { LogsExplorerLocatorParams } from '@kbn/deeplinks-observability';
 import {
-  ALERT_ACTION_GROUP,
   ALERT_EVALUATION_VALUES,
   ALERT_EVALUATION_THRESHOLD,
   ALERT_REASON,
@@ -17,7 +16,7 @@ import {
 import { LocatorPublic } from '@kbn/share-plugin/common';
 import { RecoveredActionGroup } from '@kbn/alerting-plugin/common';
 import { IBasePath, Logger } from '@kbn/core/server';
-import { LifecycleRuleExecutor } from '@kbn/rule-registry-plugin/server';
+import { AlertsClientError, RuleExecutorOptions } from '@kbn/alerting-plugin/server';
 import { Group } from '../../../../common/custom_threshold_rule/types';
 import { getEvaluationValues, getThreshold } from './lib/get_values';
 import { AlertsLocatorParams, getAlertDetailsUrl } from '../../../../common';
@@ -31,8 +30,8 @@ import {
   CustomThresholdAlertState,
   CustomThresholdAlertContext,
   CustomThresholdSpecificActionGroups,
-  CustomThresholdAlertFactory,
   CustomThresholdActionGroup,
+  CustomThresholdAlert,
 } from './types';
 import {
   buildFiredAlertReason,
@@ -41,11 +40,11 @@ import {
 } from './messages';
 import {
   createScopedLogger,
-  getContextForRecoveredAlerts,
   hasAdditionalContext,
   validGroupByForContext,
   flattenAdditionalContext,
   getFormattedGroupBy,
+  getContextForRecoveredAlerts,
 } from './utils';
 
 import { formatAlertResult, getLabel } from './lib/format_alert_result';
@@ -62,20 +61,23 @@ export const createCustomThresholdExecutor = ({
   basePath,
   logger,
   config,
-  locators: { alertsLocator, logsExplorerLocator },
+  locators: { logsExplorerLocator },
 }: {
   basePath: IBasePath;
   logger: Logger;
   config: ObservabilityConfig;
   locators: CustomThresholdLocators;
-}): LifecycleRuleExecutor<
-  CustomThresholdRuleTypeParams,
-  CustomThresholdRuleTypeState,
-  CustomThresholdAlertState,
-  CustomThresholdAlertContext,
-  CustomThresholdSpecificActionGroups
-> =>
-  async function (options) {
+}) =>
+  async function (
+    options: RuleExecutorOptions<
+      CustomThresholdRuleTypeParams,
+      CustomThresholdRuleTypeState,
+      CustomThresholdAlertState,
+      CustomThresholdAlertContext,
+      CustomThresholdSpecificActionGroups,
+      CustomThresholdAlert
+    >
+  ) {
     const startTime = Date.now();
 
     const {
@@ -96,35 +98,11 @@ export const createCustomThresholdExecutor = ({
       executionId,
     });
 
-    const {
-      alertWithLifecycle,
-      getAlertUuid,
-      getAlertByAlertUuid,
-      getAlertStartedDate,
-      searchSourceClient,
-      alertFactory: baseAlertFactory,
-    } = services;
-
-    const alertFactory: CustomThresholdAlertFactory = (
-      id,
-      reason,
-      actionGroup,
-      additionalContext,
-      evaluationValues,
-      threshold,
-      group
-    ) =>
-      alertWithLifecycle({
-        id,
-        fields: {
-          [ALERT_REASON]: reason,
-          [ALERT_ACTION_GROUP]: actionGroup,
-          [ALERT_EVALUATION_VALUES]: evaluationValues,
-          [ALERT_EVALUATION_THRESHOLD]: threshold,
-          [ALERT_GROUP]: group,
-          ...flattenAdditionalContext(additionalContext),
-        },
-      });
+    const { searchSourceClient, alertsClient } = services;
+
+    if (!alertsClient) {
+      throw new AlertsClientError();
+    }
 
     const { alertOnNoData, alertOnGroupDisappear: _alertOnGroupDisappear } = params as {
       alertOnNoData: boolean;
@@ -183,7 +161,7 @@ export const createCustomThresholdExecutor = ({
     const hasGroups = !isEqual(groupArray, [UNGROUPED_FACTORY_KEY]);
     let scheduledActionsCount = 0;
 
-    const alertLimit = baseAlertFactory.alertLimit.getValue();
+    const alertLimit = alertsClient.getAlertLimitValue();
     let hasReachedLimit = false;
 
     // The key of `groupArray` is the alert instance ID.
@@ -266,64 +244,68 @@ export const createCustomThresholdExecutor = ({
         );
 
         const groups: Group[] = groupByKeysObjectMapping[group];
-        const alert = alertFactory(
-          `${group}`,
-          reason,
-          actionGroupId,
-          additionalContext,
-          evaluationValues,
-          threshold,
-          groups
-        );
-        const alertUuid = getAlertUuid(group);
-        const indexedStartedAt = getAlertStartedDate(group) ?? startedAt.toISOString();
+
+        const { uuid, start } = alertsClient.report({
+          id: `${group}`,
+          actionGroup: actionGroupId,
+          payload: {
+            [ALERT_REASON]: reason,
+            [ALERT_EVALUATION_VALUES]: evaluationValues,
+            [ALERT_EVALUATION_THRESHOLD]: threshold,
+            [ALERT_GROUP]: groups,
+            ...flattenAdditionalContext(additionalContext),
+          },
+        });
+
+        const indexedStartedAt = start ?? startedAt.toISOString();
         scheduledActionsCount++;
 
-        alert.scheduleActions(actionGroupId, {
-          alertDetailsUrl: getAlertDetailsUrl(basePath, spaceId, alertUuid),
-          group: groupByKeysObjectMapping[group],
-          reason,
-          timestamp,
-          value: alertResults.map((result) => {
-            const evaluation = result[group];
-            if (!evaluation) {
-              return null;
-            }
-            return formatAlertResult(evaluation).currentValue;
-          }),
-          viewInAppUrl: getViewInAppUrl({
-            dataViewId: params.searchConfiguration?.index?.title ?? dataViewId,
-            groups,
-            logsExplorerLocator,
-            metrics: alertResults.length === 1 ? alertResults[0][group].metrics : [],
-            searchConfiguration: params.searchConfiguration,
-            startedAt: indexedStartedAt,
-          }),
-          ...additionalContext,
+        alertsClient.setAlertData({
+          id: `${group}`,
+          context: {
+            alertDetailsUrl: getAlertDetailsUrl(basePath, spaceId, uuid),
+            group: groupByKeysObjectMapping[group],
+            reason,
+            timestamp,
+            value: alertResults.map((result) => {
+              const evaluation = result[group];
+              if (!evaluation) {
+                return null;
+              }
+              return formatAlertResult(evaluation).currentValue;
+            }),
+            viewInAppUrl: getViewInAppUrl({
+              dataViewId: params.searchConfiguration?.index?.title ?? dataViewId,
+              groups,
+              logsExplorerLocator,
+              metrics: alertResults.length === 1 ? alertResults[0][group].metrics : [],
+              searchConfiguration: params.searchConfiguration,
+              startedAt: indexedStartedAt,
+            }),
+            ...additionalContext,
+          },
         });
       }
     }
 
-    baseAlertFactory.alertLimit.setLimitReached(hasReachedLimit);
-    const { getRecoveredAlerts } = services.alertFactory.done();
-    const recoveredAlerts = getRecoveredAlerts();
+    alertsClient.setAlertLimitReached(hasReachedLimit);
+    const recoveredAlerts = alertsClient.getRecoveredAlerts() ?? [];
 
     const groupByKeysObjectForRecovered = getFormattedGroupBy(
       params.groupBy,
-      new Set<string>(recoveredAlerts.map((recoveredAlert) => recoveredAlert.getId()))
+      new Set<string>(recoveredAlerts.map((recoveredAlert) => recoveredAlert.alert.getId()))
     );
 
-    for (const alert of recoveredAlerts) {
-      const recoveredAlertId = alert.getId();
-      const alertUuid = getAlertUuid(recoveredAlertId);
-      const timestamp = startedAt.toISOString();
-      const indexedStartedAt = getAlertStartedDate(recoveredAlertId) ?? timestamp;
+    for (const recoveredAlert of recoveredAlerts) {
+      const recoveredAlertId = recoveredAlert.alert.getId();
+      const alertUuid = recoveredAlert.alert.getUuid();
+      const indexedStartedAt = recoveredAlert.alert.getStart() ?? startedAt.toISOString();
       const group = groupByKeysObjectForRecovered[recoveredAlertId];
 
-      const alertHits = alertUuid ? await getAlertByAlertUuid(alertUuid) : undefined;
+      const alertHits = recoveredAlert.hit;
       const additionalContext = getContextForRecoveredAlerts(alertHits);
 
-      alert.setContext({
+      const context = {
         alertDetailsUrl: getAlertDetailsUrl(basePath, spaceId, alertUuid),
         group,
         timestamp: startedAt.toISOString(),
@@ -336,6 +318,11 @@ export const createCustomThresholdExecutor = ({
           startedAt: indexedStartedAt,
         }),
         ...additionalContext,
+      };
+
+      alertsClient.setAlertData({
+        id: recoveredAlertId,
+        context,
       });
     }
 

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/register_custom_threshold_rule_type.ts

@@ -14,7 +14,6 @@ import { IRuleTypeAlerts, GetViewInAppRelativeUrlFnOpts } from '@kbn/alerting-pl
 import { IBasePath, Logger } from '@kbn/core/server';
 import { legacyExperimentalFieldMap } from '@kbn/alerts-as-data-utils';
 import { OBSERVABILITY_THRESHOLD_RULE_TYPE_ID } from '@kbn/rule-data-utils';
-import { createLifecycleExecutor, IRuleDataClient } from '@kbn/rule-registry-plugin/server';
 import { LicenseType } from '@kbn/licensing-plugin/server';
 import { EsQueryRuleParamsExtractedParams } from '@kbn/stack-alerts-plugin/server/rule_types/es_query/rule_type_params';
 import { observabilityFeatureId, observabilityPaths } from '../../../../common';
@@ -42,12 +41,14 @@ import {
 } from './custom_threshold_executor';
 import { CUSTOM_THRESHOLD_AAD_FIELDS, FIRED_ACTION, NO_DATA_ACTION } from './constants';
 import { ObservabilityConfig } from '../../..';
+import { CustomThresholdAlert } from './types';
 
-export const MetricsRulesTypeAlertDefinition: IRuleTypeAlerts = {
+export const MetricsRulesTypeAlertDefinition: IRuleTypeAlerts<CustomThresholdAlert> = {
   context: THRESHOLD_RULE_REGISTRATION_CONTEXT,
   mappings: { fieldMap: legacyExperimentalFieldMap },
   useEcs: true,
   useLegacyAlerts: false,
+  shouldWrite: true,
 };
 
 export const searchConfigurationSchema = schema.object({
@@ -68,14 +69,10 @@ export const searchConfigurationSchema = schema.object({
   ),
 });
 
-type CreateLifecycleExecutor = ReturnType<typeof createLifecycleExecutor>;
-
 export function thresholdRuleType(
-  createLifecycleRuleExecutor: CreateLifecycleExecutor,
   basePath: IBasePath,
   config: ObservabilityConfig,
   logger: Logger,
-  ruleDataClient: IRuleDataClient,
   locators: CustomThresholdLocators
 ) {
   const baseCriterion = {
@@ -145,9 +142,7 @@ export function thresholdRuleType(
     actionGroups: [FIRED_ACTION, NO_DATA_ACTION],
     minimumLicenseRequired: 'basic' as LicenseType,
     isExportable: true,
-    executor: createLifecycleRuleExecutor(
-      createCustomThresholdExecutor({ basePath, logger, config, locators })
-    ),
+    executor: createCustomThresholdExecutor({ basePath, logger, config, locators }),
     doesSetRecoveryContext: true,
     actionVariables: {
       context: [

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/types.ts

@@ -12,15 +12,19 @@ import {
   RecoveredActionGroup,
   RuleTypeState,
 } from '@kbn/alerting-plugin/common';
-import { Alert } from '@kbn/alerting-plugin/server';
+import { ObservabilityMetricsAlert } from '@kbn/alerts-as-data-utils';
+import {
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUES,
+  ALERT_GROUP,
+} from '@kbn/rule-data-utils';
 import {
   CustomMetricExpressionParams,
   Group,
   SearchConfigurationWithExtractedReferenceType,
 } from '../../../../common/custom_threshold_rule/types';
 import { FIRED_ACTIONS_ID, NO_DATA_ACTIONS_ID, FIRED_ACTION, NO_DATA_ACTION } from './constants';
 import { MissingGroupsRecord } from './lib/check_missing_group';
-import { AdditionalContext } from './utils';
 
 export enum AlertStates {
   OK,
@@ -63,23 +67,17 @@ export type CustomThresholdActionGroup =
   | typeof NO_DATA_ACTIONS_ID
   | typeof RecoveredActionGroup.id;
 
-export type CustomThresholdAlertFactory = (
-  id: string,
-  reason: string,
-  actionGroup: CustomThresholdActionGroup,
-  additionalContext?: AdditionalContext | null,
-  evaluationValues?: Array<number | null>,
-  threshold?: Array<number | null>,
-  group?: Group[]
-) => CustomThresholdAlert;
-
-type CustomThresholdAlert = Alert<
-  CustomThresholdAlertState,
-  CustomThresholdAlertContext,
-  CustomThresholdSpecificActionGroups
->;
-
 export interface AlertExecutionDetails {
   alertId: string;
   executionId: string;
 }
+
+export type CustomThresholdAlert = Omit<
+  ObservabilityMetricsAlert,
+  'kibana.alert.evaluation.values' | 'kibana.alert.evaluation.threshold' | 'kibana.alert.group'
+> & {
+  // Defining a custom type for this because the schema generation script doesn't allow explicit null values
+  [ALERT_EVALUATION_VALUES]?: Array<number | null>;
+  [ALERT_EVALUATION_THRESHOLD]?: Array<number | null>;
+  [ALERT_GROUP]?: Group[];
+};

x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/utils.ts

@@ -16,6 +16,7 @@ import { ES_FIELD_TYPES } from '@kbn/field-types';
 import { set } from '@kbn/safer-lodash-set';
 import { ParsedExperimentalFields } from '@kbn/rule-registry-plugin/common/parse_experimental_fields';
 import { ParsedTechnicalFields } from '@kbn/rule-registry-plugin/common';
+import { Alert } from '@kbn/alerts-as-data-utils';
 import type { Group } from '../../../../common/custom_threshold_rule/types';
 import { ObservabilityConfig } from '../../..';
 import { AlertExecutionDetails } from './types';
@@ -183,8 +184,10 @@ export const flattenAdditionalContext = (
   return additionalContext ? flattenObject(additionalContext) : {};
 };
 
-export const getContextForRecoveredAlerts = (
-  alertHitSource: Partial<ParsedTechnicalFields & ParsedExperimentalFields> | undefined | null
+export const getContextForRecoveredAlerts = <
+  T extends Alert | (ParsedTechnicalFields & ParsedExperimentalFields)
+>(
+  alertHitSource: Partial<T> | undefined | null
 ): AdditionalContext => {
   const alert = alertHitSource ? unflattenObject(alertHitSource) : undefined;