[Discuss] Ability to interact with the alert query result - User requests

[arisonl]

Internal and external customers have asked for the ability to:

• interact with alert queries
• transform the results of the queries (e.g. with painless)
• log query results

This is frequently discussed in the context of the search query. Example use cases:

• Transform query results in order to populate action parameters as they need. I am linking a related enhancement request below, as well as internal requirements (Infra team).
• Setting up a dynamic condition. For example set up a dynamic threshold of the type trigger if the aggregation of the metric within the set window is X times greater than that of the previous window.
• More generally this would help migrating from Watcher (which offers ways to interact with the alert payload) customers who use watches that cannot currently be met with Kibana alerting.
• An additional use case involves logging the query results for audit purposes. However there is perhaps a better path for this use case, one involving the new Kibana audit logging (which provides with a trace ID that allows users to link Kibana with ES audit logs) and an enhancement request for ES audit logs. The combination would allow users to audit alert queries and their results.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[pmuellr]

The "log query" aspects of this seem like something we should split off to a separate issue. Get some "trace ids" in our requests, probably add them to the event log, and make it as easy as possible for alert type implementations to log their "queries" to the Kibana log. I'm not sure what the audit log is capturing for "queries" done by alert type implementations today, but if there's anything we can improve on, we definitely should.

[mikecote]

Issue to be more specific, "how to transform data between alert and action (ex: math)".

[arisonl]

As mentioned in the description, there is the log query use case can be met with a combination of the new Kibana audit logging (which provides with a trace ID that allows users to link Kibana with ES audit logs) and an enhancement request for ES audit logs which I have now opened.