[Observability RAC] document xpack.ruleRegistry.write.disabledRegistrationContexts flag

[mgiota]

Description

In this issue we introduced a new xpack.ruleRegistry.write.disabledRegistrationContexts flag, which user can use to disable writing to alerts-as-data indices in a more granular way.

Collaboration

• The docs team will define with product team the structure and location, and the product team will provide the initial content

xpack.ruleRegistry.write.disabledRegistrationContexts::
Specifies the observability alert indices that are disabled to be written. Data type is array. Allowed values are: [ 'observability.logs','observability.metrics','observability.apm','observability.uptime' ]

Contact Person:
@mgiota

Suggested Target Release

8.0.0

[colleenmcginnis]

@mgiota should information on this new flag replace the content at the beginning of View Alerts?

[colleenmcginnis]

@vinaychandrasekhar can you help with the question above?

[vinaychandrasekhar]

@mgiota would be the right person to answer the query. @mgiota thoughts please when you get a chance?

[mgiota]

@colleenmcginnis No this new flag doesn't replace the content at the beginning of View Alerts. It just gives the option to the user to disable writing to observability alerts-as-data indices in a more granular way per observability plugin.

To make it more clear. For example:

• if user wants to disable only the Logs Alerts, they should still keep xpack.observability.unsafe.alertingExperience.enabled: true and xpack.ruleRegistry.write.enabled: true and specify xpack.ruleRegistry.write.disabledRegistrationContexts : ['observability.logs'].
• Same way if they wanted to disable Uptime alerts they should specify xpack.ruleRegistry.write.disabledRegistrationContexts : ['observability.uptime']. Something to note here: this would disable uptime alerts coming from all Uptime rule types (monitor status rule and tls rule types). We currently don't have an even more granular way to disable alerts per observability rule type. Currently the disabling option is per observability plugin (which in our code we call registrationContext)
• if they want to disable Logs and Uptime alerts, they should specify xpack.ruleRegistry.write.disabledRegistrationContexts : ['observability.logs', 'observability.uptime]
• if they want to disable alerts in general they should specify xpack.observability.unsafe.alertingExperience.enabled: false and xpack.ruleRegistry.write.enabled: false (they don't need to explicitly specify all 4 observability registration contexts)

On another note xpack.observability.unsafe.cases.enabled will hide the Cases option from the Observability sidebar.

• So I am wondering why xpack.observability.unsafe.cases.enabled is listed there as a prerequisite to disable Alerts Page. @vinaychandrasekhar do you agree that we should remove xpack.observability.unsafe.cases.enabled from the list? We could mention separately how they can disable the Cases page.
• Also I have the impression that Cases is not experimental. It was released before Alerts. @vinaychandrasekhar Do you know more on this?

@colleenmcginnis Let me know if everything is clear.