Currently we have kibana.alert.instance.id in all alerts that saves comma separated group values in the alert document. We would like to have a field that provides information in the form of {field, value} pair, and allows for individual {field, value} to be searchable/queryable in the alert document. The requirement of this field is discussed in the RFC here.

Based on the discussion in above RFC, the Custom threshold rule saves group information in AAD with kibana.alert.group field which is an array of { field: field-name, value: field-value }.

We need to streamline the method of saving group information in AAD across all Observability rules.

Use cases

• The field should be searchable/queryable reliably without false positives
• Auto-suggestion on KQL bar should suggest this field
• Use in action template of "Summary of alerts" action frequency (described in comment below) without relying on index

Rules where group info should be saved in its dedicated field in alert document

• ES Query rule - currently does not save group information
• Custom threshold rule - currently has kibana.alert.group array
• Metric threshold rule - currently has kibana.alert.group array
• Log threshold rule - currently has kibana.alert.group array
• SLO burn rate rule - currently has kibana.alert.group array
• Inventory threshold rule

Needs more discussion

• APM Latency threshold rule
• APM Failed transaction rate threshold rule
• APM Error count rule
• Synthetics monitor status
• Anomaly detection

Acceptance criteria

• Have same field with same structure to save group information in alert document across all Observability rules