[RAC] Decouple registry from alerts-as-data client (#98935)

package.json

@@ -136,9 +136,9 @@
     "@kbn/logging": "link:bazel-bin/packages/kbn-logging/npm_module",
     "@kbn/monaco": "link:packages/kbn-monaco",
     "@kbn/securitysolution-constants": "link:bazel-bin/packages/kbn-securitysolution-constants/npm_module",
-    "@kbn/securitysolution-utils": "link:bazel-bin/packages/kbn-securitysolution-utils/npm_module",
     "@kbn/securitysolution-es-utils": "link:bazel-bin/packages/kbn-securitysolution-es-utils/npm_module",
     "@kbn/securitysolution-io-ts-utils": "link:bazel-bin/packages/kbn-securitysolution-io-ts-utils/npm_module",
+    "@kbn/securitysolution-utils": "link:bazel-bin/packages/kbn-securitysolution-utils/npm_module",
     "@kbn/server-http-tools": "link:packages/kbn-server-http-tools",
     "@kbn/server-route-repository": "link:packages/kbn-server-route-repository",
     "@kbn/std": "link:bazel-bin/packages/kbn-std/npm_module",
@@ -265,6 +265,7 @@
     "json-stringify-safe": "5.0.1",
     "jsonwebtoken": "^8.5.1",
     "jsts": "^1.6.2",
+    "@kbn/rule-data-utils": "link:packages/kbn-rule-data-utils",
     "kea": "^2.3.0",
     "leaflet": "1.5.1",
     "leaflet-draw": "0.4.14",

packages/kbn-optimizer/limits.yml

@@ -61,7 +61,6 @@ pageLoadAssetSize:
   remoteClusters: 51327
   reporting: 183418
   rollup: 97204
-  ruleRegistry: 100000
   savedObjects: 108518
   savedObjectsManagement: 101836
   savedObjectsTagging: 59482

packages/kbn-rule-data-utils/jest.config.js

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../..',
+  roots: ['<rootDir>/packages/kbn-rule-data-utils'],
+};

packages/kbn-rule-data-utils/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@kbn/rule-data-utils",
+  "main": "./target/index.js",
+  "types": "./target/index.d.ts",
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0",
+  "private": true,
+  "scripts": {
+    "build": "../../node_modules/.bin/tsc",
+    "kbn:bootstrap": "yarn build",
+    "kbn:watch": "yarn build --watch"
+  }
+}

packages/kbn-rule-data-utils/src/index.ts

@@ -0,0 +1,9 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export * from './technical_field_names';

packages/kbn-rule-data-utils/src/technical_field_names.ts

@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import { ValuesType } from 'utility-types';
+
+const ALERT_NAMESPACE = 'kibana.rac.alert';
+
+const TIMESTAMP = '@timestamp' as const;
+const EVENT_KIND = 'event.kind' as const;
+const EVENT_ACTION = 'event.action' as const;
+const RULE_UUID = 'rule.uuid' as const;
+const RULE_ID = 'rule.id' as const;
+const RULE_NAME = 'rule.name' as const;
+const RULE_CATEGORY = 'rule.category' as const;
+const TAGS = 'tags' as const;
+const PRODUCER = `${ALERT_NAMESPACE}.producer` as const;
+const ALERT_ID = `${ALERT_NAMESPACE}.id` as const;
+const ALERT_UUID = `${ALERT_NAMESPACE}.uuid` as const;
+const ALERT_START = `${ALERT_NAMESPACE}.start` as const;
+const ALERT_END = `${ALERT_NAMESPACE}.end` as const;
+const ALERT_DURATION = `${ALERT_NAMESPACE}.duration.us` as const;
+const ALERT_SEVERITY_LEVEL = `${ALERT_NAMESPACE}.severity.level` as const;
+const ALERT_SEVERITY_VALUE = `${ALERT_NAMESPACE}.severity.value` as const;
+const ALERT_STATUS = `${ALERT_NAMESPACE}.status` as const;
+const ALERT_EVALUATION_THRESHOLD = `${ALERT_NAMESPACE}.evaluation.threshold` as const;
+const ALERT_EVALUATION_VALUE = `${ALERT_NAMESPACE}.evaluation.value` as const;
+
+const fields = {
+  TIMESTAMP,
+  EVENT_KIND,
+  EVENT_ACTION,
+  RULE_UUID,
+  RULE_ID,
+  RULE_NAME,
+  RULE_CATEGORY,
+  TAGS,
+  PRODUCER,
+  ALERT_ID,
+  ALERT_UUID,
+  ALERT_START,
+  ALERT_END,
+  ALERT_DURATION,
+  ALERT_SEVERITY_LEVEL,
+  ALERT_SEVERITY_VALUE,
+  ALERT_STATUS,
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+};
+
+export {
+  TIMESTAMP,
+  EVENT_KIND,
+  EVENT_ACTION,
+  RULE_UUID,
+  RULE_ID,
+  RULE_NAME,
+  RULE_CATEGORY,
+  TAGS,
+  PRODUCER,
+  ALERT_ID,
+  ALERT_UUID,
+  ALERT_START,
+  ALERT_END,
+  ALERT_DURATION,
+  ALERT_SEVERITY_LEVEL,
+  ALERT_SEVERITY_VALUE,
+  ALERT_STATUS,
+  ALERT_EVALUATION_THRESHOLD,
+  ALERT_EVALUATION_VALUE,
+};
+
+export type TechnicalRuleDataFieldName = ValuesType<typeof fields>;

packages/kbn-rule-data-utils/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "incremental": false,
+    "outDir": "./target",
+    "stripInternal": false,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "sourceRoot": "../../../../packages/kbn-rule-data-utils/src",
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "./src/**/*.ts"
+  ]
+}

typings/elasticsearch/search.d.ts

@@ -49,7 +49,7 @@ type ValueTypeOfField<T> = T extends Record<string, string | number>
 
 type MaybeArray<T> = T | T[];
 
-type Fields = MaybeArray<string | estypes.DateField>;
+type Fields = Exclude<Required<estypes.SearchRequest>['body']['fields'], undefined>;
 type DocValueFields = MaybeArray<string | estypes.DocValueField>;
 
 export type SearchHit<
@@ -58,7 +58,7 @@ export type SearchHit<
   TDocValueFields extends DocValueFields | undefined = undefined
 > = Omit<estypes.Hit, '_source' | 'fields'> &
   (TSource extends false ? {} : { _source: TSource }) &
-  (TFields extends estypes.Fields
+  (TFields extends Fields
     ? {
         fields: Partial<Record<ValueTypeOfField<TFields>, unknown[]>>;
       }
@@ -77,7 +77,7 @@ type HitsOf<
 > = Array<
   SearchHit<
     TOptions extends { _source: false } ? undefined : TDocument,
-    TOptions extends { fields: estypes.Fields } ? TOptions['fields'] : undefined,
+    TOptions extends { fields: Fields } ? TOptions['fields'] : undefined,
     TOptions extends { docvalue_fields: DocValueFields } ? TOptions['docvalue_fields'] : undefined
   >
 >;

x-pack/plugins/apm/kibana.json

@@ -10,7 +10,8 @@
     "triggersActionsUi",
     "embeddable",
     "infra",
-    "observability"
+    "observability",
+    "ruleRegistry"
   ],
   "optionalPlugins": [
     "spaces",
@@ -26,8 +27,13 @@
   ],
   "server": true,
   "ui": true,
-  "configPath": ["xpack", "apm"],
-  "extraPublicDirs": ["public/style/variables"],
+  "configPath": [
+    "xpack",
+    "apm"
+  ],
+  "extraPublicDirs": [
+    "public/style/variables"
+  ],
   "requiredBundles": [
     "home",
     "kibanaReact",

x-pack/plugins/apm/public/application/application.test.tsx

@@ -39,7 +39,11 @@ describe('renderApp', () => {
   });
 
   it('renders the app', () => {
-    const { core, config, apmRuleRegistry } = mockApmPluginContextValue;
+    const {
+      core,
+      config,
+      observabilityRuleTypeRegistry,
+    } = mockApmPluginContextValue;
     const plugins = {
       licensing: { license$: new Observable() },
       triggersActionsUi: { actionTypeRegistry: {}, alertTypeRegistry: {} },
@@ -92,7 +96,7 @@ describe('renderApp', () => {
         appMountParameters: params as any,
         pluginsStart: startDeps as any,
         config,
-        apmRuleRegistry,
+        observabilityRuleTypeRegistry,
       });
     });
 

x-pack/plugins/apm/public/application/csmApp.tsx

@@ -12,6 +12,7 @@ import React from 'react';
 import ReactDOM from 'react-dom';
 import { Route, Router } from 'react-router-dom';
 import { DefaultTheme, ThemeProvider } from 'styled-components';
+import type { ObservabilityRuleTypeRegistry } from '../../../observability/public';
 import { euiStyled } from '../../../../../src/plugins/kibana_react/common';
 import {
   KibanaContextProvider,
@@ -26,11 +27,7 @@ import { ApmPluginContext } from '../context/apm_plugin/apm_plugin_context';
 import { UrlParamsProvider } from '../context/url_params_context/url_params_context';
 import { useBreadcrumbs } from '../hooks/use_breadcrumbs';
 import { ConfigSchema } from '../index';
-import {
-  ApmPluginSetupDeps,
-  ApmPluginStartDeps,
-  ApmRuleRegistry,
-} from '../plugin';
+import { ApmPluginSetupDeps, ApmPluginStartDeps } from '../plugin';
 import { createCallApmApi } from '../services/rest/createCallApmApi';
 import { px, units } from '../style/variables';
 import { createStaticIndexPattern } from '../services/rest/index_pattern';
@@ -77,14 +74,14 @@ export function CsmAppRoot({
   deps,
   config,
   corePlugins: { embeddable, maps },
-  apmRuleRegistry,
+  observabilityRuleTypeRegistry,
 }: {
   appMountParameters: AppMountParameters;
   core: CoreStart;
   deps: ApmPluginSetupDeps;
   config: ConfigSchema;
   corePlugins: ApmPluginStartDeps;
-  apmRuleRegistry: ApmRuleRegistry;
+  observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry;
 }) {
   const { history } = appMountParameters;
   const i18nCore = core.i18n;
@@ -94,7 +91,7 @@ export function CsmAppRoot({
     config,
     core,
     plugins,
-    apmRuleRegistry,
+    observabilityRuleTypeRegistry,
   };
 
   return (
@@ -125,14 +122,14 @@ export const renderApp = ({
   appMountParameters,
   config,
   corePlugins,
-  apmRuleRegistry,
+  observabilityRuleTypeRegistry,
 }: {
   core: CoreStart;
   deps: ApmPluginSetupDeps;
   appMountParameters: AppMountParameters;
   config: ConfigSchema;
   corePlugins: ApmPluginStartDeps;
-  apmRuleRegistry: ApmRuleRegistry;
+  observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry;
 }) => {
   const { element } = appMountParameters;
 
@@ -151,7 +148,7 @@ export const renderApp = ({
       deps={deps}
       config={config}
       corePlugins={corePlugins}
-      apmRuleRegistry={apmRuleRegistry}
+      observabilityRuleTypeRegistry={observabilityRuleTypeRegistry}
     />,
     element
   );

x-pack/plugins/apm/public/application/index.tsx

@@ -13,6 +13,7 @@ import ReactDOM from 'react-dom';
 import { Route, Router, Switch } from 'react-router-dom';
 import 'react-vis/dist/style.css';
 import { DefaultTheme, ThemeProvider } from 'styled-components';
+import type { ObservabilityRuleTypeRegistry } from '../../../observability/public';
 import { euiStyled } from '../../../../../src/plugins/kibana_react/common';
 import { ConfigSchema } from '../';
 import { AppMountParameters, CoreStart } from '../../../../../src/core/public';
@@ -30,11 +31,7 @@ import {
 import { LicenseProvider } from '../context/license/license_context';
 import { UrlParamsProvider } from '../context/url_params_context/url_params_context';
 import { useBreadcrumbs } from '../hooks/use_breadcrumbs';
-import {
-  ApmPluginSetupDeps,
-  ApmPluginStartDeps,
-  ApmRuleRegistry,
-} from '../plugin';
+import { ApmPluginSetupDeps, ApmPluginStartDeps } from '../plugin';
 import { createCallApmApi } from '../services/rest/createCallApmApi';
 import { createStaticIndexPattern } from '../services/rest/index_pattern';
 import { setHelpExtension } from '../setHelpExtension';
@@ -112,22 +109,22 @@ export const renderApp = ({
   appMountParameters,
   config,
   pluginsStart,
-  apmRuleRegistry,
+  observabilityRuleTypeRegistry,
 }: {
   coreStart: CoreStart;
   pluginsSetup: ApmPluginSetupDeps;
   appMountParameters: AppMountParameters;
   config: ConfigSchema;
   pluginsStart: ApmPluginStartDeps;
-  apmRuleRegistry: ApmRuleRegistry;
+  observabilityRuleTypeRegistry: ObservabilityRuleTypeRegistry;
 }) => {
   const { element } = appMountParameters;
   const apmPluginContextValue = {
     appMountParameters,
     config,
     core: coreStart,
     plugins: pluginsSetup,
-    apmRuleRegistry,
+    observabilityRuleTypeRegistry,
   };
 
   // render APM feedback link in global help menu