[Observability alerts table] Improve default alert table fields

[maryam-saeidi]

🍒 Summary

The current set of default fields in the alert table is not useful enough for our users. Based on a feedback (author: @elkargig ) provided by @roshan-elastic and some SRE interviews that @maciejforcone did, we would like to change the default alert table fields to the following:

1. Triggered
2. Duration
3. Rule name
   • rule name (on hover: show rule category)
4. source
   • group by field
5. Observed value
6. Difference
   • diff of observed and threshold (show threshold on hover)
7. Tags

Also, we would like to adjust the default time range to 2 hours instead of 15 mins.

🎯 Acceptance Criteria

• Adjust the default list of alerts table columns as mentioned above
• Change the default time range to 2 hours

What will be covered in separate PR

• Making sure all rules set the threshold field
  [Observability rules] Save threshold information in AAD in kibana.alert.evaluation.threshold field #175136
• Adding a column with difference (Needs to be discussed with ResponseOps team)
  [Alert table] Add a column to show the difference between observed value and threshold #175139
• Having source column instead of group by field (Needs to be discussed with @maciejforcone )
  [Alert table] Adding source column to the observability alert table #175141

[elasticmachine]

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

[roshan-elastic]

Hey @maryam-saeidi - thanks for picking this up! I was trying to figure out which table this was but I couldn't find the fields in the UI.

Do you have a rough mock-up/screenshot of the now vs proposed?

Note : Even if it's just annotations of what would change that would be super helpful

[maryam-saeidi]

Hi @roshan-elastic,

Sorry for the late reply, here is roughly what the old and new tables look like:

Old alert table	New alert table

There are still some things missing that I am working on, including:

1. A column to show the difference between the observed value and threshold.
2. Making sure all the rules have the threshold value populated in the same way.
3. Showing information on hover such as rule category.

Please let me know if you have any feedback.

[elkargig]

Thank you, this looks much better already

[roshan-elastic]

Let me go and ask @elkargig what he thinks...oh wait - he likes it! :)

Great job @maryam-saeidi - we're also looking to present more sensible defaults in this component in the hosts feature:

Link

In this context, we clearly need the host name to show...so we're looking to add it in.

[maryam-saeidi]

@roshan-elastic We can register different alert tables for different purposes with a set of default columns that makes sense in each context. I am refactoring the registration of a new table to make it easier to add a separate one for hosts in this case.

[roshan-elastic]

ooh amazing @maryam-saeidi !