[ResponseOps][Alerting] Deprecate and remove references to action variables in the ui and in tests that are no longer used (#161136)

Resolves https://github.com/elastic/kibana/issues/161126 ## Summary Removes references to the following list of action variables in the code and in the UI: | Mustache legacy variable | Recommended replacement expression | To be deprecated | ----------- | ----------- | ----------- | | alertId | rule.id | yes | | alertName | rule.name | yes | | spaceId | rule.spaceId | yes | | tags | rule.tags | yes | | params | rule.params | yes | | alertInstanceId | alert.id | yes | | alertActionGroup | alert.actionGroup | yes | | alertActionSubgroup | alert.actionSubgroup | yes | | alertActionGroupName | alert.actionGroupName | yes | Also deprecates `params` in favor of `rule.params` ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### Checklist 1. Create an es query/index threshold rule and add a connector 2. Verify that the default message does not contain any legacy variables 3. Click on the list of available action variables and verify that `params` is deprecated and all the params variables are prefixed with `rules.` ## Release Note The following rule action variables have been deprecated; use the recommended variables (in parentheses) instead: - `alertActionGroup` (`alert.actionGroup`) - `alertActionGroupName` (`alert.actionGroupName`) - `alertActionSubgroup` (`alert.actionSubgroup`) - `alertId` (`rule.id`) - `alertInstanceId` (`alert.id`) - `alertName` (`rule.name`) - `params` (`rule.params`) - `spaceId` (`rule.spaceId`) - `tags` (`rule.tags`)
2025-04-23 17:28:26 -04:00 · 2023-07-13 11:15:27 -04:00 · 2023-07-13 11:15:27 -04:00 · 568ad803bc
commit 568ad803bc
parent 2abbda3001
24 changed files with 86 additions and 73 deletions
--- a/x-pack/plugins/actions/common/alert_history_schema.ts
+++ b/x-pack/plugins/actions/common/alert_history_schema.ts
@ -95,7 +95,7 @@ export const AlertHistoryDocumentTemplate = Object.freeze(
      spaceId: '{{rule.spaceId}}',
    },
    context: '{{context}}',
-    params: '{{params}}',
+    params: '{{rule.params}}',
    tags: '{{rule.tags}}',
    alert: {
      id: '{{alert.id}}',
--- a/x-pack/plugins/alerting/README.md
+++ b/x-pack/plugins/alerting/README.md
@ -874,7 +874,7 @@ Below is an example of a rule that takes advantage of templating:
        "from": "example@elastic.co",
        "to": ["destination@elastic.co"],
        "subject": "A notification about {{context.server}}",
-        "body": "The server {{context.server}} has a CPU usage of {{state.cpuUsage}}%. This message for {{alertInstanceId}} was created by the rule {{alertId}} {{alertName}}."
+        "body": "The server {{context.server}} has a CPU usage of {{state.cpuUsage}}%. This message for {{alert.id}} was created by the rule {{rule.id}} {{rule.name}}."
      }
    }
  ]
--- a/x-pack/plugins/alerting/server/manual_tests/action_param_templates.sh
+++ b/x-pack/plugins/alerting/server/manual_tests/action_param_templates.sh
@ -70,7 +70,7 @@ ACTION_ID_WEBHOOK=`curl -X POST --insecure --silent \
  }" | jq -r '.id'`
 echo "webhook action id: $ACTION_ID_WEBHOOK"

-WEBHOOK_BODY="{ \\\"text\\\": \\\"text from webhook {{alertName}}\\\" }"
+WEBHOOK_BODY="{ \\\"text\\\": \\\"text from webhook {{rule.name}}\\\" }"

 # create alert
 ALERT_ID=`curl -X POST --insecure --silent \
@ -88,15 +88,15 @@ ALERT_ID=`curl -X POST --insecure --silent \
        \"id\": \"$ACTION_ID_EMAIL\",
        \"params\":{
          \"to\": [\"team-alerting@example.com\"],
-          \"subject\": \"subject {{alertName}}\",
-          \"message\": \"message {{alertName}}\"
+          \"subject\": \"subject {{rule.name}}\",
+          \"message\": \"message {{rule.name}}\"
        }
      },
      {
        \"group\": \"threshold met\",
        \"id\": \"$ACTION_ID_SLACK\",
        \"params\":{
-          \"message\": \"message from slack {{alertName}}\"
+          \"message\": \"message from slack {{rule.name}}\"
        }
      },
      {
--- a/x-pack/plugins/alerting/server/task_runner/execution_handler.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/execution_handler.test.ts
@ -97,7 +97,8 @@ const rule = {
        foo: true,
        contextVal: 'My {{context.value}} goes here',
        stateVal: 'My {{state.value}} goes here',
-        alertVal: 'My {{alertId}} {{alertName}} {{spaceId}} {{tags}} {{alertInstanceId}} goes here',
+        alertVal:
+          'My {{rule.id}} {{rule.name}} {{rule.spaceId}} {{rule.tags}} {{alert.id}} goes here',
      },
      uuid: '111-111',
    },
@ -656,7 +657,7 @@ describe('Execution Handler', () => {
          contextVal: 'My {{context.value}} goes here',
          stateVal: 'My {{state.value}} goes here',
          alertVal:
-            'My {{alertId}} {{alertName}} {{spaceId}} {{tags}} {{alertInstanceId}} goes here',
+            'My {{rule.id}} {{rule.name}} {{rule.spaceId}} {{rule.tags}} {{alert.id}} goes here',
        },
      },
    ];
@ -725,7 +726,7 @@ describe('Execution Handler', () => {
                contextVal: 'My {{context.value}} goes here',
                stateVal: 'My {{state.value}} goes here',
                alertVal:
-                  'My {{alertId}} {{alertName}} {{spaceId}} {{tags}} {{alertInstanceId}} goes here',
+                  'My {{rule.id}} {{rule.name}} {{rule.spaceId}} {{rule.tags}} {{alert.id}} goes here',
              },
            },
          ],
@ -1209,7 +1210,7 @@ describe('Execution Handler', () => {
          contextVal: 'My {{context.value}} goes here',
          stateVal: 'My {{state.value}} goes here',
          alertVal:
-            'My {{alertId}} {{alertName}} {{spaceId}} {{tags}} {{alertInstanceId}} goes here',
+            'My {{rule.id}} {{rule.name}} {{rule.spaceId}} {{rule.tags}} {{alert.id}} goes here',
        },
      },
      {
@ -1221,7 +1222,7 @@ describe('Execution Handler', () => {
          contextVal: 'My {{context.value}} goes here',
          stateVal: 'My {{state.value}} goes here',
          alertVal:
-            'My {{alertId}} {{alertName}} {{spaceId}} {{tags}} {{alertInstanceId}} goes here',
+            'My {{rule.id}} {{rule.name}} {{rule.spaceId}} {{rule.tags}} {{alert.id}} goes here',
        },
      },
    ];
--- a/x-pack/plugins/alerting/server/task_runner/transform_action_params.test.ts
+++ b/x-pack/plugins/alerting/server/task_runner/transform_action_params.test.ts
@ -31,7 +31,7 @@ describe('transformActionParams', () => {
      empty1: null,
      empty2: undefined,
      date: '2019-02-12T21:01:22.479Z',
-      message: 'Value "{{params.foo}}" exists',
+      message: 'Value "{{rule.params.foo}}" exists',
    };
    const result = transformActionParams({
      actionsPlugin,
--- a/x-pack/plugins/osquery/common/utils/replace_params_query.test.ts
+++ b/x-pack/plugins/osquery/common/utils/replace_params_query.test.ts
@ -9,7 +9,7 @@ import { replaceParamsQuery } from './replace_params_query';

 describe('replaceParamsQuery', () => {
  it('should return unchanged query, and skipped true', () => {
-    const query = 'SELECT * FROM processes WHERE version = {{params.version}}';
+    const query = 'SELECT * FROM processes WHERE version = {{rule.params.version}}';
    const { result, skipped } = replaceParamsQuery(query, {});
    expect(result).toBe(query);
    expect(skipped).toBe(true);
@ -46,7 +46,7 @@ describe('replaceParamsQuery', () => {
    expect(result).toBe(expectedQuery);
    expect(skipped).toBe(false);
  });
-  it('should return skipped true if {{params}} field not found', () => {
+  it('should return skipped true if {{rule.params}} field not found', () => {
    const query =
      'SELECT * FROM processes WHERE version = {{kibana.version}} {{not.existing}} {{agent.name}}';
    const { result, skipped } = replaceParamsQuery(query, {
--- a/x-pack/plugins/stack_alerts/public/rule_types/es_query/index.ts
+++ b/x-pack/plugins/stack_alerts/public/rule_types/es_query/index.ts
@ -31,10 +31,10 @@ export function getRuleType(alerting: AlertingSetup): RuleTypeModel<EsQueryRuleP
    defaultActionMessage: i18n.translate(
      'xpack.stackAlerts.esQuery.ui.alertType.defaultActionMessage',
      {
-        defaultMessage: `Elasticsearch query alert '\\{\\{alertName\\}\\}' is active:
+        defaultMessage: `Elasticsearch query rule '\\{\\{rule.name\\}\\}' is active:

 - Value: \\{\\{context.value\\}\\}
- Conditions Met: \\{\\{context.conditions\\}\\} over \\{\\{params.timeWindowSize\\}\\}\\{\\{params.timeWindowUnit\\}\\}
+- Conditions Met: \\{\\{context.conditions\\}\\} over \\{\\{rule.params.timeWindowSize\\}\\}\\{\\{rule.params.timeWindowUnit\\}\\}
 - Timestamp: \\{\\{context.date\\}\\}
 - Link: \\{\\{context.link\\}\\}`,
      }
--- a/x-pack/plugins/stack_alerts/public/rule_types/threshold/index.ts
+++ b/x-pack/plugins/stack_alerts/public/rule_types/threshold/index.ts
@ -24,10 +24,10 @@ export function getRuleType(): RuleTypeModel<IndexThresholdRuleParams> {
    defaultActionMessage: i18n.translate(
      'xpack.stackAlerts.threshold.ui.alertType.defaultActionMessage',
      {
-        defaultMessage: `alert '\\{\\{alertName\\}\\}' is active for group '\\{\\{context.group\\}\\}':
+        defaultMessage: `Rule '\\{\\{rule.name\\}\\}' is active for group '\\{\\{context.group\\}\\}':

 - Value: \\{\\{context.value\\}\\}
- Conditions Met: \\{\\{context.conditions\\}\\} over \\{\\{params.timeWindowSize\\}\\}\\{\\{params.timeWindowUnit\\}\\}
+- Conditions Met: \\{\\{context.conditions\\}\\} over \\{\\{rule.params.timeWindowSize\\}\\}\\{\\{rule.params.timeWindowUnit\\}\\}
 - Timestamp: \\{\\{context.date\\}\\}`,
      }
    ),
--- a/x-pack/plugins/translations/translations/fr-FR.json
+++ b/x-pack/plugins/translations/translations/fr-FR.json
@ -34638,7 +34638,6 @@
    "xpack.stackAlerts.esQuery.termFieldRequiredErrorMessage": "[termField] : termField requis lorsque [groupBy] est Premiers",
    "xpack.stackAlerts.esQuery.termSizeRequiredErrorMessage": "[termSize] : termSize requis lorsque [groupBy] est Premiers",
    "xpack.stackAlerts.esQuery.ui.alertParams.fixErrorInExpressionBelowValidationMessage": "L'expression contient des erreurs.",
-    "xpack.stackAlerts.esQuery.ui.alertType.defaultActionMessage": "L'alerte de recherche Elasticsearch \"\\{\\{alertName\\}\\}\" est active :\n\n- Valeur : \\{\\{context.value\\}\\}\n- Conditions remplies : \\{\\{context.conditions\\}\\} sur \\{\\{params.timeWindowSize\\}\\}\\{\\{params.timeWindowUnit\\}\\}\n- Horodatage : \\{\\{context.date\\}\\}\n- Lien : \\{\\{context.link\\}\\}",
    "xpack.stackAlerts.esQuery.ui.alertType.descriptionText": "Alerte lorsque des correspondances sont trouvées au cours de la dernière exécution de la requête.",
    "xpack.stackAlerts.esQuery.ui.conditionsPrompt": "Définir le groupe, le seuil et la fenêtre de temps",
    "xpack.stackAlerts.esQuery.ui.copyQuery": "Copier la requête",
@ -34734,7 +34733,6 @@
    "xpack.stackAlerts.indexThreshold.actionVariableContextValueLabel": "Valeur ayant dépassé le seuil.",
    "xpack.stackAlerts.indexThreshold.alertTypeTitle": "Seuil de l'index",
    "xpack.stackAlerts.threshold.ui.alertParams.fixErrorInExpressionBelowValidationMessage": "L'expression contient des erreurs.",
-    "xpack.stackAlerts.threshold.ui.alertType.defaultActionMessage": "l'alerte \"\\{\\{alertName\\}\\}\" est active pour le groupe \"\\{\\{context.group\\}\\}\" :\n\n- Valeur : \\{\\{context.value\\}\\}\n- Conditions remplies : \\{\\{context.conditions\\}\\} sur \\{\\{params.timeWindowSize\\}\\}\\{\\{params.timeWindowUnit\\}\\}\n- Horodatage : \\{\\{context.date\\}\\}",
    "xpack.stackAlerts.threshold.ui.alertType.descriptionText": "Alerte lorsqu'une recherche agrégée atteint le seuil.",
    "xpack.stackAlerts.threshold.ui.conditionPrompt": "Définir la condition",
    "xpack.stackAlerts.threshold.ui.filterKQLHelpText": "Utilisez une expression KQL pour limiter la portée de votre déclenchement d'alerte.",
--- a/x-pack/plugins/translations/translations/ja-JP.json
+++ b/x-pack/plugins/translations/translations/ja-JP.json
@ -34623,7 +34623,6 @@
    "xpack.stackAlerts.esQuery.termFieldRequiredErrorMessage": "[termField]：[groupBy]がトップのときにはtermFieldが必要です",
    "xpack.stackAlerts.esQuery.termSizeRequiredErrorMessage": "[termSize]：[groupBy]がトップのときにはtermSizeが必要です",
    "xpack.stackAlerts.esQuery.ui.alertParams.fixErrorInExpressionBelowValidationMessage": "下の表現のエラーを修正してください。",
-    "xpack.stackAlerts.esQuery.ui.alertType.defaultActionMessage": "Elasticsearchクエリアラート'\\{\\{alertName\\}\\}'が有効です。\n\n- 値：\\{\\{context.value\\}\\}\n- 満たされた条件：\\{\\{context.conditions\\}\\} over \\{\\{params.timeWindowSize\\}\\}\\{\\{params.timeWindowUnit\\}\\}\n- タイムスタンプ：\\{\\{context.date\\}\\}\n- リンク：\\{\\{context.link\\}\\}",
    "xpack.stackAlerts.esQuery.ui.alertType.descriptionText": "前回のクエリ実行中に一致が見つかったときにアラートを発行します。",
    "xpack.stackAlerts.esQuery.ui.conditionsPrompt": "グループ、しきい値、時間枠を設定",
    "xpack.stackAlerts.esQuery.ui.copyQuery": "クエリをコピー",
@ -34719,7 +34718,6 @@
    "xpack.stackAlerts.indexThreshold.actionVariableContextValueLabel": "しきい値を超えた値。",
    "xpack.stackAlerts.indexThreshold.alertTypeTitle": "インデックスしきい値",
    "xpack.stackAlerts.threshold.ui.alertParams.fixErrorInExpressionBelowValidationMessage": "下の表現のエラーを修正してください。",
-    "xpack.stackAlerts.threshold.ui.alertType.defaultActionMessage": "アラート '\\{\\{alertName\\}\\}' はグループ '\\{\\{context.group\\}\\}' でアクティブです：\n\n- 値：\\{\\{context.value\\}\\}\n- 満たされた条件：\\{\\{context.conditions\\}\\} over \\{\\{params.timeWindowSize\\}\\}\\{\\{params.timeWindowUnit\\}\\}\n- タイムスタンプ：\\{\\{context.date\\}\\}",
    "xpack.stackAlerts.threshold.ui.alertType.descriptionText": "アグリゲーションされたクエリがしきい値に達したときにアラートを発行します。",
    "xpack.stackAlerts.threshold.ui.conditionPrompt": "条件を定義してください",
    "xpack.stackAlerts.threshold.ui.filterKQLHelpText": "KQL式を使用して、アラートトリガーの範囲を制限します。",
--- a/x-pack/plugins/translations/translations/zh-CN.json
+++ b/x-pack/plugins/translations/translations/zh-CN.json
@ -34617,7 +34617,6 @@
    "xpack.stackAlerts.esQuery.termFieldRequiredErrorMessage": "[termField]：[groupBy] 为 top 时，termField 为必需",
    "xpack.stackAlerts.esQuery.termSizeRequiredErrorMessage": "[termSize]：[groupBy] 为 top 时，termSize 为必需",
    "xpack.stackAlerts.esQuery.ui.alertParams.fixErrorInExpressionBelowValidationMessage": "表达式包含错误。",
-    "xpack.stackAlerts.esQuery.ui.alertType.defaultActionMessage": "Elasticsearch 查询告警“\\{\\{alertName\\}\\}”处于活动状态：\n\n- 值：\\{\\{context.value\\}\\}\n- 满足的条件：\\{\\{context.conditions\\}\\} 超过 \\{\\{params.timeWindowSize\\}\\}\\{\\{params.timeWindowUnit\\}\\}\n- 时间戳：\\{\\{context.date\\}\\}\n- 链接：\\{\\{context.link\\}\\}",
    "xpack.stackAlerts.esQuery.ui.alertType.descriptionText": "在运行最新查询期间找到匹配项时告警。",
    "xpack.stackAlerts.esQuery.ui.conditionsPrompt": "设置组、阈值和时间窗口",
    "xpack.stackAlerts.esQuery.ui.copyQuery": "复制查询",
@ -34713,7 +34712,6 @@
    "xpack.stackAlerts.indexThreshold.actionVariableContextValueLabel": "超过阈值的值。",
    "xpack.stackAlerts.indexThreshold.alertTypeTitle": "索引阈值",
    "xpack.stackAlerts.threshold.ui.alertParams.fixErrorInExpressionBelowValidationMessage": "表达式包含错误。",
-    "xpack.stackAlerts.threshold.ui.alertType.defaultActionMessage": "组“\\{\\{context.group\\}\\}”的告警“\\{\\{alertName\\}\\}”处于活动状态：\n\n- 值：\\{\\{context.value\\}\\}\n- 满足的条件：\\{\\{context.conditions\\}\\} 超过 \\{\\{params.timeWindowSize\\}\\}\\{\\{params.timeWindowUnit\\}\\}\n- 时间戳：\\{\\{context.date\\}\\}",
    "xpack.stackAlerts.threshold.ui.alertType.descriptionText": "聚合查询达到阈值时告警。",
    "xpack.stackAlerts.threshold.ui.conditionPrompt": "定义条件",
    "xpack.stackAlerts.threshold.ui.filterKQLHelpText": "使用 KQL 表达式限制告警触发的范围。",
--- a/x-pack/plugins/triggers_actions_ui/README.md
+++ b/x-pack/plugins/triggers_actions_ui/README.md
@ -1038,9 +1038,9 @@ Example of the index document for Index Threshold alert:

 ```
 {
-    "alert_id": "{{alertId}}",
-    "alert_name": "{{alertName}}",
-    "alert_instance_id": "{{alertInstanceId}}",
+    "rule_id": "{{rule.id}}",
+    "rule_name": "{{rule.name}}",
+    "alert_id": "{{alert.id}}",
    "context_title": "{{context.title}}",
    "context_value": "{{context.value}}",
    "context_message": "{{context.message}}"
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/action_variables.test.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_variables.test.ts
@ -113,6 +113,11 @@ const expectedTransformResult = [
    description: 'This has been deprecated in favor of rule.tags.',
    name: 'tags',
  },
+  {
+    deprecated: true,
+    description: 'This has been deprecated in favor of rule.params.',
+    name: 'params',
+  },
 ];

 const expectedContextTransformResult = (withBraces: boolean = false) => [
@ -139,7 +144,7 @@ const expectedStateTransformResult = (withBraces: boolean = false) => [
 const expectedParamsTransformResult = (withBraces: boolean = false) => [
  {
    description: 'fooP-description',
-    name: 'params.fooP',
+    name: 'rule.params.fooP',
    ...(withBraces && { useWithTripleBracesInTemplates: true }),
  },
 ];
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/action_variables.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/action_variables.ts
@ -26,7 +26,7 @@ function transformProvidedActionVariables(
      : pick(actionVariables, [...REQUIRED_ACTION_VARIABLES, ...CONTEXT_ACTION_VARIABLES])
    : actionVariables;

-  const paramsVars = prefixKeys(filteredActionVariables.params, 'params.');
+  const paramsVars = prefixKeys(filteredActionVariables.params, 'rule.params.');
  const contextVars = filteredActionVariables.context
    ? prefixKeys(filteredActionVariables.context, 'context.')
    : [];
@ -68,6 +68,7 @@ export enum AlertProvidedActionVariables {
  ruleTags = 'rule.tags',
  ruleType = 'rule.type',
  ruleUrl = 'rule.url',
+  ruleParams = 'rule.params',
  date = 'date',
  alertId = 'alert.id',
  alertActionGroup = 'alert.actionGroup',
@ -86,6 +87,7 @@ export enum LegacyAlertProvidedActionVariables {
  alertActionSubgroup = 'alertActionSubgroup',
  tags = 'tags',
  spaceId = 'spaceId',
+  params = 'params',
 }

 export enum SummaryAlertProvidedActionVariables {
@ -324,6 +326,17 @@ function getAlwaysProvidedActionVariables(): ActionVariable[] {
    }),
  });

+  result.push({
+    name: LegacyAlertProvidedActionVariables.params,
+    deprecated: true,
+    description: i18n.translate('xpack.triggersActionsUI.actionVariables.legacyParamsLabel', {
+      defaultMessage: 'This has been deprecated in favor of {variable}.',
+      values: {
+        variable: AlertProvidedActionVariables.ruleParams,
+      },
+    }),
+  });
+
  return result;
 }
 function getSummaryAlertActionVariables(): ActionVariable[] {
--- a/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/create.test.ts
+++ b/x-pack/plugins/triggers_actions_ui/public/application/lib/rule_api/create.test.ts
@ -82,7 +82,7 @@ describe('createRule', () => {
          params: {
            level: 'info',
            message:
-              "alert '{{alertName}}' is active for group '{{context.group}}':\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}",
+              "Rule '{{rule.name}}' is active for group '{{context.group}}':\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}",
          },
          actionTypeId: '.server-log',
          frequency: {
--- a/x-pack/test/alerting_api_integration/common/lib/alert_utils.ts
+++ b/x-pack/test/alerting_api_integration/common/lib/alert_utils.ts
@ -417,12 +417,12 @@ function getDefaultAlwaysFiringAlertData(
  notifyWhen = 'onActiveAlert'
 ) {
  const messageTemplate = `
-alertId: {{alertId}},
-alertName: {{alertName}},
-spaceId: {{spaceId}},
-tags: {{tags}},
-alertInstanceId: {{alertInstanceId}},
-alertActionGroup: {{alertActionGroup}},
+ruleId: {{rule.id}},
+ruleName: {{rule.name}},
+spaceId: {{rule.spaceId}},
+tags: {{rule.tags}},
+alertId: {{alert.id}},
+alertActionGroup: {{alert.actionGroup}},
 instanceContextValue: {{context.instanceContextValue}},
 instanceStateValue: {{state.instanceStateValue}}
 `.trim();
@ -461,12 +461,12 @@ function getAlwaysFiringAlertWithThrottledActionData(
  summary = false
 ) {
  const messageTemplate = `
-alertId: {{alertId}},
-alertName: {{alertName}},
-spaceId: {{spaceId}},
-tags: {{tags}},
-alertInstanceId: {{alertInstanceId}},
-alertActionGroup: {{alertActionGroup}},
+ruleId: {{rule.id}},
+ruleName: {{rule.name}},
+spaceId: {{rule.spaceId}},
+tags: {{rule.tags}},
+alertId: {{alert.id}},
+alertActionGroup: {{alert.actionGroup}},
 instanceContextValue: {{context.instanceContextValue}},
 instanceStateValue: {{state.instanceStateValue}}
 `.trim();
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/alerts.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/alerts.ts
@ -208,11 +208,11 @@ export default function alertTests({ getService }: FtrProviderContext) {
                  index: ES_TEST_INDEX_NAME,
                  reference,
                  message: `
-alertId: ${alertId},
-alertName: abc,
+ruleId: ${alertId},
+ruleName: abc,
 spaceId: ${space.id},
 tags: tag-A,tag-B,
-alertInstanceId: 1,
+alertId: 1,
 alertActionGroup: default,
 instanceContextValue: true,
 instanceStateValue: true
@ -331,11 +331,11 @@ instanceStateValue: true
                  index: ES_TEST_INDEX_NAME,
                  reference,
                  message: `
-alertId: ${alertId},
-alertName: abc,
+ruleId: ${alertId},
+ruleName: abc,
 spaceId: ${space.id},
 tags: tag-A,tag-B,
-alertInstanceId: 1,
+alertId: 1,
 alertActionGroup: default,
 instanceContextValue: true,
 instanceStateValue: true
--- a/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/mustache_templates.ts
+++ b/x-pack/test/alerting_api_integration/security_and_spaces/group2/tests/alerting/mustache_templates.ts
@ -92,7 +92,7 @@ export default function executionStatusAlertTests({ getService }: FtrProviderCon
                id: createdAction.id,
                group: 'default',
                params: {
-                  message: `message {{alertId}} - ${varsTemplate}`,
+                  message: `message {{rule.id}} - ${varsTemplate}`,
                },
              },
            ],
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/alerts_base.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/alerts_base.ts
@ -158,11 +158,11 @@ export function alertTests({ getService }: FtrProviderContext, space: Space) {
          index: ES_TEST_INDEX_NAME,
          reference,
          message: `
-alertId: ${alertId},
-alertName: abc,
+ruleId: ${alertId},
+ruleName: abc,
 spaceId: ${space.id},
 tags: tag-A,tag-B,
-alertInstanceId: 1,
+alertId: 1,
 alertActionGroup: default,
 instanceContextValue: true,
 instanceStateValue: true
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group2/ml_rule_types/anomaly_detection/alert.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group2/ml_rule_types/anomaly_detection/alert.ts
@ -168,7 +168,7 @@ export default function alertTests({ getService }: FtrProviderContext) {
              source: ES_TEST_INDEX_SOURCE,
              reference: ES_TEST_INDEX_REFERENCE,
              params: {
-                name: '{{{alertName}}}',
+                name: '{{{rule.name}}}',
                message: '{{{context.message}}}',
                anomalyExplorerUrl: '{{{context.anomalyExplorerUrl}}}',
              },
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group2/transform_rule_types/transform_health/alert.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group2/transform_rule_types/transform_health/alert.ts
@ -135,7 +135,7 @@ export default function alertTests({ getService }: FtrProviderContext) {
              source: ES_TEST_INDEX_SOURCE,
              reference: ES_TEST_INDEX_REFERENCE,
              params: {
-                name: '{{{alertName}}}',
+                name: '{{{rule.name}}}',
                message: '{{{context.message}}}',
              },
            },
--- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/mustache_templates.ts
+++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group4/mustache_templates.ts
@ -73,7 +73,7 @@ export default function executionStatusAlertTests({ getService }: FtrProviderCon
          id: webhookConnector.id,
          group: 'default',
          params: {
-            body: `payload {{alertId}} - ${template}`,
+            body: `payload {{rule.id}} - ${template}`,
          },
        });
        const body = await retry.try(async () => waitForActionBody(webhookSimulatorURL, rule.id));
@ -90,7 +90,7 @@ export default function executionStatusAlertTests({ getService }: FtrProviderCon
          id: slackConnector.id,
          group: 'default',
          params: {
-            message: `message {{alertId}} - ${template}`,
+            message: `message {{rule.id}} - ${template}`,
          },
        });

@ -106,7 +106,7 @@ export default function executionStatusAlertTests({ getService }: FtrProviderCon
          id: slackConnector.id,
          group: 'default',
          params: {
-            message: `message {{alertId}} - ${template}`,
+            message: `message {{rule.id}} - ${template}`,
          },
        });
        const body = await retry.try(async () => waitForActionBody(slackSimulatorURL, rule.id));
@ -121,7 +121,7 @@ export default function executionStatusAlertTests({ getService }: FtrProviderCon
          id: slackConnector.id,
          group: 'default',
          params: {
-            message: `message {{alertId}} - ${template}`,
+            message: `message {{rule.id}} - ${template}`,
          },
        });

@ -155,7 +155,7 @@ export default function executionStatusAlertTests({ getService }: FtrProviderCon
          id: webhookConnector.id,
          group: 'default',
          params: {
-            body: `payload {{alertId}} - ${template}`,
+            body: `payload {{rule.id}} - ${template}`,
          },
        });
        const body = await retry.try(async () => waitForActionBody(webhookSimulatorURL, rule.id));
@ -173,7 +173,7 @@ export default function executionStatusAlertTests({ getService }: FtrProviderCon
          id: webhookConnector.id,
          group: 'default',
          params: {
-            body: `payload {{alertId}} - ${template}`,
+            body: `payload {{rule.id}} - ${template}`,
          },
        });
        const body = await retry.try(async () => waitForActionBody(webhookSimulatorURL, rule.id));
@ -192,7 +192,7 @@ export default function executionStatusAlertTests({ getService }: FtrProviderCon
          id: slackConnector.id,
          group: 'default',
          params: {
-            message: `message {{alertId}} - ${template}`,
+            message: `message {{rule.id}} - ${template}`,
          },
        });
        const body = await retry.try(async () => waitForActionBody(slackSimulatorURL, rule.id));
@ -209,7 +209,7 @@ export default function executionStatusAlertTests({ getService }: FtrProviderCon
          id: slackConnector.id,
          group: 'default',
          params: {
-            message: `message {{alertId}} - ${template}`,
+            message: `message {{rule.id}} - ${template}`,
          },
        });
        const body = await retry.try(async () => waitForActionBody(slackSimulatorURL, rule.id));
@ -227,7 +227,7 @@ export default function executionStatusAlertTests({ getService }: FtrProviderCon
        id: slackConnector.id,
        group: 'default',
        params: {
-          message: `message {{alertId}} - ${template}`,
+          message: `message {{rule.id}} - ${template}`,
        },
      });
      const body = await retry.try(async () => waitForActionBody(slackSimulatorURL, rule.id));
--- a/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/discover/search_source_alert.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/discover_ml_uptime/discover/search_source_alert.ts
@ -171,9 +171,9 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {
    });

    await monacoEditor.setCodeEditorValue(`{
-      "rule_id": "{{ruleId}}",
-      "rule_name": "{{ruleName}}",
-      "alert_id": "{{alertId}}",
+      "rule_id": "{{rule.id}}",
+      "rule_name": "{{rule.name}}",
+      "alert_id": "{{alert.id}}",
      "context_message": "{{context.message}}"
    }`);
  };
@ -214,19 +214,19 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) {

    await PageObjects.discover.selectIndexPattern(OUTPUT_DATA_VIEW);

-    let alertId: string;
+    let ruleId: string;
    if (type === 'name') {
      const [{ id }] = await getAlertsByName(value);
-      alertId = id;
+      ruleId = id;
    } else {
-      alertId = value;
+      ruleId = value;
    }

-    await filterBar.addFilter({ field: 'alert_id', operation: 'is', value: alertId });
+    await filterBar.addFilter({ field: 'rule_id', operation: 'is', value: ruleId });
    await PageObjects.discover.waitUntilSearchingHasFinished();

    const link = await getResultsLink();
-    await filterBar.removeFilter('alert_id'); // clear filter bar
+    await filterBar.removeFilter('rule_id'); // clear filter bar

    // follow url provided by alert to see documents triggered the alert
    const baseUrl = deployment.getHostPort();
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/alert_create_flyout.ts
@ -144,10 +144,10 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
      await testSubjects.setValue('throttleInput', '10');
      const messageTextArea = await find.byCssSelector('[data-test-subj="messageTextArea"]');
      expect(await messageTextArea.getAttribute('value')).to.eql(
-        `alert '{{alertName}}' is active for group '{{context.group}}':
+        `Rule '{{rule.name}}' is active for group '{{context.group}}':

 - Value: {{context.value}}
- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}
+- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}
 - Timestamp: {{context.date}}`
      );
      await testSubjects.setValue('messageTextArea', 'test message ');