Save ECS group by fields at the root level of alerting document

[maryam-saeidi]

Summary

Currently, we save group-related fields at the root level in AAD depending on the group by field as described here.

Since group by field is an important field that can be used in various features such as maintenance window or conditional action to filter alerts, we would like to expand the above-mentioned logic to save the group by fields at the root level if they are ECS fields.

Implementation idea

We can create a shared function and pass all the group-by fields to this function and return only fields that are ECS-compliant, then we can use this logic in all the rules that have group-by functionality:

• Custom threshold
  [Custom threshold] Save the ECS group by fields at the AAD root level #188241
• Metric threshold
  [Metric threshold] Save the ECS group by fields at the AAD root level #188976
• Log threshold
  [Log threhsod, SLO burn rate] Save the ECS group by fields at the AAD root level #189260
• Inventory threshold Does not have group by and already saves related context at the root level
• SLO burn rate
  [Log threhsod, SLO burn rate] Save the ECS group by fields at the AAD root level #189260
• ES Query
  [ES Query] Save ECS keyword group by fields in AAD document #191103

Acceptance criteria

• Create a shared logic to get the list of ECS-compliant group by fields and save that information at the root level of the alert document

Documentation Summary request

• [Request]: [Draft] Document additional context for observability rules observability-docs#4075

[elasticmachine]

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)