[ResponseOps] use Data Streams for AAD indices in serverless

Changes the way the alerts-as-data (AAD) indices are created and written
to, to allow them to be built as they have been in the past (alias and
backing indices created manually) OR as an ES Data Stream.

Serverless will use Data Streams, other environments will use the
existing alias and backing indices.

The configuration `xpack.alerting.useDataStreamForAlerts` determines
which to use, and is false by default.

This configuration is not intended to be used by customers, as it when
used in the wrong environment, will cause failures creating and writing
to the alert indices.

PR elastic#160572

- fix jest test
- start integrating bits of the dataStreamAdapter
- fix tests
- fix function tests
- fix FT
- change the rule registry writer
- fix FT
- start using the new ds adapter to create alias indices
- add create data stream logic
- use alias by default createConcreteWriteIndex() as it's being called by other plugins now
- start adapting jest tests to test datastream alerts as well
- extend create_concrete_write_index jest tests for data stream
- rebase, fix merge conflicts
- fix jest test after merge conflict
- convert the RR trial test to use data streams
- fix jest test, remove ILM for datastream, run serverless o11y test with ds, add rr test with ds
- fix jest and function tests
- fix jest tests

.buildkite/ftr_configs.yml

@@ -351,7 +351,7 @@ enabled:
   - x-pack/test/reporting_functional/reporting_and_timeout.config.ts
   - x-pack/test/rule_registry/security_and_spaces/config_basic.ts
   - x-pack/test/rule_registry/security_and_spaces/config_trial.ts
-  - x-pack/test/rule_registry/spaces_only/config_basic.ts
+  - x-pack/test/rule_registry/spaces_only/config_trial_datastream.ts
   - x-pack/test/rule_registry/spaces_only/config_trial.ts
   - x-pack/test/saved_object_api_integration/security_and_spaces/config_basic.ts
   - x-pack/test/saved_object_api_integration/security_and_spaces/config_trial.ts

src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker

@@ -231,6 +231,7 @@ kibana_vars=(
     xpack.alerting.rules.run.actions.max
     xpack.alerting.rules.run.alerts.max
     xpack.alerting.rules.run.actions.connectorTypeOverrides
+    xpack.alerting.useDataStreamForAlerts
     xpack.alerts.healthCheck.interval
     xpack.alerts.invalidateApiKeysTask.interval
     xpack.alerts.invalidateApiKeysTask.removalDelay

x-pack/plugins/alerting/server/alerts_service/alerts_service.ts

@@ -20,6 +20,8 @@ import {
   getIndexTemplateAndPattern,
 } from './resource_installer_utils';
 import { AlertInstanceContext, AlertInstanceState, IRuleTypeAlerts, RuleAlertData } from '../types';
+import { AlertingConfig } from '../config';
+import { DataStreamAdapter, getDataStreamAdapter } from './lib/data_stream_adapter';
 import {
   createResourceInstallationHelper,
   errorResult,
@@ -47,6 +49,7 @@ interface AlertsServiceParams {
   logger: Logger;
   pluginStop$: Observable<void>;
   kibanaVersion: string;
+  config: AlertingConfig;
   elasticsearchClientPromise: Promise<ElasticsearchClient>;
   timeoutMs?: number;
 }
@@ -114,10 +117,13 @@ export class AlertsService implements IAlertsService {
   private resourceInitializationHelper: ResourceInstallationHelper;
   private registeredContexts: Map<string, IRuleTypeAlerts> = new Map();
   private commonInitPromise: Promise<InitializationPromise>;
+  private dataStreamAdapter: DataStreamAdapter;
 
   constructor(private readonly options: AlertsServiceParams) {
     this.initialized = false;
 
+    this.dataStreamAdapter = getDataStreamAdapter(options.config);
+
     // Kick off initialization of common assets and save the promise
     this.commonInitPromise = this.initializeCommon(this.options.timeoutMs);
 
@@ -296,6 +302,7 @@ export class AlertsService implements IAlertsService {
             esClient,
             name: DEFAULT_ALERTS_ILM_POLICY_NAME,
             policy: DEFAULT_ALERTS_ILM_POLICY,
+            dataStreamAdapter: this.dataStreamAdapter,
           }),
         () =>
           createOrUpdateComponentTemplate({
@@ -421,6 +428,7 @@ export class AlertsService implements IAlertsService {
             kibanaVersion: this.options.kibanaVersion,
             namespace,
             totalFieldsLimit: TOTAL_FIELDS_LIMIT,
+            dataStreamAdapter: this.dataStreamAdapter,
           }),
         }),
       async () =>
@@ -429,6 +437,7 @@ export class AlertsService implements IAlertsService {
           esClient,
           totalFieldsLimit: TOTAL_FIELDS_LIMIT,
           indexPatterns: indexTemplateAndPattern,
+          dataStreamAdapter: this.dataStreamAdapter,
         }),
     ]);