[RAC] Observability alerts table: update cell actions

[katrin-freihofner]

We want to update the cell actions in the Observability alerts table to improve usability. We defined the cell actions for our default columns and default actions for all optional columns.

AC:

• Timestamp and Duration column: expand action (no filter in/out)
• Reason column: expand action (We decided this works ok based on how data grid "email" column example works)
• All other columns: expand, filter in/out
• Remove all other cell actions

Notes:

• The design issue provides more background information and example of the consistent experience across solutions.
• Observability specific proposed implementation:
  

[elasticmachine]

Pinging @elastic/logs-metrics-ui (Team:logs-metrics-ui)

[jasonrhodes]

Updated description to clarify AC

[claudiopro]

Hi @katrin-freihofner, what is the expected behavior when the user filters in and then filters out the same value? Should this result in the removal of the filter, as I'd assume? The alternative would result into adding two mutually exclusive conditions to the query (e.g. kibana.alert.status: 'active' and not kibana.alert.status: 'active'), resulting into an empty result set:

There is also another issue affecting current builds. The user can repeatedly filter in for the same value, resulting in a redundant KQL query which may also cause degradation of performance (I assume the KQL optimizer removes duplicate conditions?).

[weltenwort]

@claudiopro good catches. We accepted these quirks in the interest of time back then with the intention to have the actions be backed by the structured filters and filter manager in the future. I created #116135 to track that effort.

[claudiopro]

Thanks for the background @weltenwort! This is really helpful to understand some tradeoffs and design decisions made in code 😮

[hbharding]

Hi @claudiopro! Thanks for asking. Yes, when users filter in and then filter out, this should cause the filter to be removed. The filters shouldn't build on top of eachother, as you described as an alternative.