[Alerting] Rules are storing actions using predefined connectors in references array

[ymao1]

Currently, when rules are created/updated, the connector IDs for their associated actions are extracted and stored in the SO references array. This is being done regardless of whether the connector is predefined or not. With the upcoming changes to make rules and connectors share-capable, all the IDs in the references array for SOs in a non-default space will be re-generated. This means the IDs for pre-defined connectors will be updated, even though they should not be, and the link between rule action and predefined connector will be lost.

Example Rule prior to migration:

{
    "_index" : ".kibana_7.14.1_001",
    "_id" : "yo:alert:139523f0-0069-11ec-aa21-059e5fd523e6",
    "_score" : 0.0,
    "_source" : {
        "alert" : {
            ...other rule stuff
            "actions" : [
              {
                "actionTypeId" : ".server-log",
                "params" : {
                  "level" : "info",
                  "message" : "PRECONFIGURED"
                },
                "actionRef" : "action_0",
                "group" : "small"
              },
              {
                "actionTypeId" : ".server-log",
                "params" : {
                  "level" : "info",
                  "message" : "NOT PRECONFIGURED"
                },
                "actionRef" : "action_1",
                "group" : "small"
              }
            ],
        },
        "type" : "alert",
        "references" : [
            {
              "id" : "preconfigured-server-log",
              "name" : "action_0",
              "type" : "action"
            },
            {
              "id" : "0c8a5080-0069-11ec-aa21-059e5fd523e6",
              "name" : "action_1",
              "type" : "action"
            }
        ],
      }
  }

and after migration to share-capable:

{
    "_index" : ".kibana_8.0.0_001",
    "_id" : "alert:6b75b1f9-90a0-58ed-884b-72ba8134a8a2",
    "_score" : 0.0,
    "_source" : {
        "alert" : {
            ...other rule stuff
            "actions" : [
              {
                "actionTypeId" : ".server-log",
                "params" : {
                  "level" : "info",
                  "message" : "PRECONFIGURED"
                },
                "actionRef" : "action_0",
                "group" : "small"
              },
              {
                "actionTypeId" : ".server-log",
                "params" : {
                  "level" : "info",
                  "message" : "NOT PRECONFIGURED"
                },
                "actionRef" : "action_1",
                "group" : "small"
              }
            ],
        },
        "type" : "alert",
        "references" : [
            {
              "id" : "a3334f61-dd79-5ecd-9788-76a9a69dfd99",
              "name" : "action_0",
              "type" : "action"
            },
            {
              "id" : "4521fe6b-1929-56c6-9ce7-a1a8d13bfb27",
              "name" : "action_1",
              "type" : "action"
            }
        ],
      }
  }

Note that the ID for reference entry action_0 has changed from preconfigured-server-log to a3334f61-dd79-5ecd-9788-76a9a69dfd99. When this rule tries to execute actions post-migration, it will fail with a saved object not found error when trying to retrieve the connector for a3334f61-dd79-5ecd-9788-76a9a69dfd99.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[ymao1]

We will need to update the create/update behavior in the rules client to not store pre-defined connector IDs in the references array and also write a migration to fix previous rules.

[ymao1]

One side effect of removing preconfigured connectors from being stored in the references array is that when connectors are retrieved using GET /api/actions/connectors, there is an aggregation that is performed to determine how many rules are using each connector. This aggregation is performed against the references array

kibana/x-pack/plugins/actions/server/actions_client.ts

Lines 536 to 590 in 92ec225

	async function injectExtraFindData(
	defaultKibanaIndex: string,
	scopedClusterClient: IScopedClusterClient,
	actionResults: ActionResult[]
	): Promise<FindActionResult[]> {
	const aggs: Record<string, estypes.AggregationsAggregationContainer> = {};
	for (const actionResult of actionResults) {
	aggs[actionResult.id] = {
	filter: {
	bool: {
	must: {
	nested: {
	path: 'references',
	query: {
	bool: {
	filter: {
	bool: {
	must: [
	{
	term: {
	'references.id': actionResult.id,
	},
	},
	{
	term: {
	'references.type': 'action',
	},
	},
	],
	},
	},
	},
	},
	},
	},
	},
	},
	};
	}
	const { body: aggregationResult } = await scopedClusterClient.asInternalUser.search({
	index: defaultKibanaIndex,
	body: {
	aggs,
	size: 0,
	query: {
	match_all: {},
	},
	},
	});
	return actionResults.map((actionResult) => ({
	...actionResult,
	// @ts-expect-error aggegation type is not specified
	referencedByCount: aggregationResult.aggregations[actionResult.id].doc_count,
	}));
	}

If we're not storing preconfigured connector IDs in the references array, their referencedByCount value will always be 0. What I can't find is anywhere this value is used.