[7.x] Convert event log's duration from number to string in Kibana (keep as "long" in Elasticsearch)

[mikecote]

Fixes #143562.

Backport of #130819 to 7.x.

Steps to verify

1. Fake alert event log durations to be 1 year by changing the following code

https://github.com/elastic/kibana/pull/144837/files#diff-27ff694dc534e9e509d43b00c563eabada722db2371c9bcf016ff3c8b929c5fbR706
const duration = millisToNanos(31556926000);

2. Create a rule that creates an alert consistently (ex: index threshold)

3. Let the rule run a few times

4. See event log now capturing long durations successfully

curl -XGET 'https://elastic:changeme@localhost:9200/.kibana-event-log*/_search?pretty' -k

[mikecote]

@elasticmachine merge upstream

[mikecote]

@elasticmachine merge upstream

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 0b89fd7
• Storybooks Preview

Failed CI Steps

• Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution

Test Failures

• [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution / Alert details with unmapped fields "before each" hook for "Displays the unmapped field on the JSON view"
• [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution / Detection rules, machine learning Creates and activates a new ml rule
• [job] [logs] Rules, Alerts and Exceptions ResponseOps Cypress Tests on Security Solution / Detection rules, override Creates and activates a new custom rule with override option

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
eventLog	84	92	+8

Unknown metric groups

API count

id	before	after	diff
eventLog	84	92	+8

History

• 💔 Build #86757 failed 410c9ea
• 💔 Build #86650 failed a673b2e
• 💔 Build #86408 failed b1b304c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @mikecote

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[ersin-erdal]

Added a comment about changing duration, sequence and severity type mapping.

[ersin-erdal]

Did you change these manually? I don't see any change on mappings.js

[mikecote]

With the change, the data type in Elasticsearch will remain the same long type (hence no change there), but I had to change the generation script and output files to indicate the accepted and returned value may be a string or a number (previously just number).

[ersin-erdal]

Gotcha, thanks :)

[ersin-erdal]

LGTM,
Tested locally and was able to see the duration field as string.