[Discover] Extend Elasticsearch query rule with search source based data fetching (#124534)

* [Discover] introduce .index-threshold rule

* [Discover] change filters in alert expression

* [Discover] fix cursor issue

* [Discover] add loading

* [Discover] separate validation params

* [Discover] add view alert route

* [Discover] enable "view in app" for alert created from discover

* [Discover] fix filter popover

* [Discover] fix linting, unit tests

* [Discover] fix remaining tests

* [Discover] add unit tests, add link back to stack management for es query

* Update src/plugins/discover/public/application/view_alert/view_alert_route.tsx

* [Discover] add tool tip for data view without time field

* [Discover] add info alert about possible document difference that triggered alert and displayed documents

* [Discover] update unit test

* [Discover] fix unit tests

* Update x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update src/plugins/discover/public/application/main/components/top_nav/open_alerts_popover.tsx

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* [Discover] fix unit tests

* [Discover] fix security solution alerts

* [Discover] fix eslint errors

* [Discover] fix unit tests

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* [Discover] apply suggestions

* [Discover] fix tests

* Update x-pack/plugins/stack_alerts/server/alert_types/es_query/alert_type/alert_type.ts

* [Discover] remove close button in filters

* Improve code structure

* Fix missing name in fetchEsQuery

* Fix messages

* Fix messages, again

* Refactor

* Refactor, add tests + a bit more of documentation

* Move size field, change text

* Implement readonly callout

* change icon in callout

* add padding to popover

* Hide query and filter UI if there are no values to display

* [Discover] add unit test, improve comparator types

* [Discover] fix linting and unit test

* [Discover] add es query alert integration tests

* [Discover] fix linting

* [Discover] uncomment one expect

* [Discover] fix latesTimestamp for searchSource type, unify test logic

* Update x-pack/plugins/stack_alerts/public/alert_types/es_query/expression/search_source_expression.tsx

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>

* [Discover] apply suggestions

* [Discover] make searchType optional, adjust tests

* [Discover] remove updated translations

* [Discover] apply suggestions

* [Discover] fix unit test

* [Discover] close popover on alert rule creation

* [Discover] apply suggestions

* [Discover] add first functional test

* [Discover] implement tests

* Move functionals x-pack since ssl is needed

* Fix potential flakiness in functional test

* [Discover] remove timeout waiter

* Fix functional test

- adding permissions to fix the functional

* [Discover] add logger

* [Discover] add more log points

* [Discover] wait for indices creation finished

* Try to fix the functional flakiness
- by creating data views in a serial way
- lets see if that work

Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>
Co-authored-by: Matthias Wilhelm <matthias.wilhelm@elastic.co>
Co-authored-by: andreadelrio <andrea.delrio@elastic.co>

x-pack/plugins/features/server/oss_features.ts

@@ -32,6 +32,7 @@ export const buildOSSFeatures = ({
       category: DEFAULT_APP_CATEGORIES.kibana,
       app: ['discover', 'kibana'],
       catalogue: ['discover'],
+      alerting: ['.es-query'],
       privileges: {
         all: {
           app: ['discover', 'kibana'],
@@ -42,6 +43,14 @@ export const buildOSSFeatures = ({
             read: ['index-pattern'],
           },
           ui: ['show', 'save', 'saveQuery'],
+          alerting: {
+            rule: {
+              all: ['.es-query'],
+            },
+            alert: {
+              all: ['.es-query'],
+            },
+          },
         },
         read: {
           app: ['discover', 'kibana'],
@@ -51,6 +60,14 @@ export const buildOSSFeatures = ({
             read: ['index-pattern', 'search', 'query'],
           },
           ui: ['show'],
+          alerting: {
+            rule: {
+              all: ['.es-query'],
+            },
+            alert: {
+              all: ['.es-query'],
+            },
+          },
         },
       },
       subFeatures: [