[Custom threshold] Save group by information with dynamic mapping

src/platform/packages/shared/kbn-alerts-as-data-utils/src/field_maps/legacy_experimental_field_map.ts

@@ -12,6 +12,7 @@ import {
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
   ALERT_EVALUATION_VALUES,
+  ALERT_GROUPING,
   ALERT_GROUP,
   ALERT_GROUP_FIELD,
   ALERT_GROUP_VALUE,
@@ -31,6 +32,12 @@ export const legacyExperimentalFieldMap = {
     required: false,
     array: true,
   },
+  [ALERT_GROUPING]: {
+    type: 'object',
+    dynamic: true,
+    array: false,
+    required: false,
+  },
   [ALERT_GROUP]: {
     type: 'object',
     array: true,

src/platform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/observability_apm_schema.ts

@@ -87,6 +87,7 @@ const ObservabilityApmAlertOptional = rt.partial({
       value: schemaStringArray,
     })
   ),
+  'kibana.alert.grouping': schemaUnknown,
   labels: schemaUnknown,
   'processor.event': schemaString,
   'service.environment': schemaString,

src/platform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/observability_logs_schema.ts

@@ -83,6 +83,7 @@ const ObservabilityLogsAlertOptional = rt.partial({
       value: schemaStringArray,
     })
   ),
+  'kibana.alert.grouping': schemaUnknown,
 });
 
 // prettier-ignore

src/platform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/observability_metrics_schema.ts

@@ -83,6 +83,7 @@ const ObservabilityMetricsAlertOptional = rt.partial({
       value: schemaStringArray,
     })
   ),
+  'kibana.alert.grouping': schemaUnknown,
 });
 
 // prettier-ignore

src/platform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/observability_slo_schema.ts

@@ -83,6 +83,7 @@ const ObservabilitySloAlertOptional = rt.partial({
       value: schemaStringArray,
     })
   ),
+  'kibana.alert.grouping': schemaUnknown,
   'slo.id': schemaString,
   'slo.instanceId': schemaString,
   'slo.revision': schemaStringOrNumber,

src/platform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/observability_threshold_schema.ts

@@ -82,6 +82,7 @@ const ObservabilityThresholdAlertOptional = rt.partial({
       value: schemaStringArray,
     })
   ),
+  'kibana.alert.grouping': schemaUnknown,
 });
 
 // prettier-ignore

src/platform/packages/shared/kbn-alerts-as-data-utils/src/schemas/generated/observability_uptime_schema.ts

@@ -89,6 +89,7 @@ const ObservabilityUptimeAlertOptional = rt.partial({
       value: schemaStringArray,
     })
   ),
+  'kibana.alert.grouping': schemaUnknown,
   labels: schemaUnknown,
   'location.id': schemaStringArray,
   'location.name': schemaStringArray,

src/platform/packages/shared/kbn-rule-data-utils/src/technical_field_names.ts

@@ -90,6 +90,7 @@ const ALERT_EVALUATION_THRESHOLD = `${ALERT_NAMESPACE}.evaluation.threshold` as
 const ALERT_EVALUATION_VALUE = `${ALERT_NAMESPACE}.evaluation.value` as const;
 const ALERT_CONTEXT = `${ALERT_NAMESPACE}.context` as const;
 const ALERT_EVALUATION_VALUES = `${ALERT_NAMESPACE}.evaluation.values` as const;
+const ALERT_GROUPING = `${ALERT_NAMESPACE}.grouping` as const;
 const ALERT_GROUP = `${ALERT_NAMESPACE}.group` as const;
 const ALERT_GROUP_FIELD = `${ALERT_GROUP}.field` as const;
 const ALERT_GROUP_VALUE = `${ALERT_GROUP}.value` as const;
@@ -134,6 +135,7 @@ const fields = {
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
   ALERT_EVALUATION_VALUES,
+  ALERT_GROUPING,
   ALERT_GROUP,
   ALERT_GROUP_FIELD,
   ALERT_GROUP_VALUE,
@@ -209,6 +211,7 @@ export {
   ALERT_EVALUATION_VALUE,
   ALERT_CONTEXT,
   ALERT_EVALUATION_VALUES,
+  ALERT_GROUPING,
   ALERT_GROUP,
   ALERT_GROUP_FIELD,
   ALERT_GROUP_VALUE,

x-pack/platform/packages/shared/alerting-rule-utils/index.ts

@@ -6,5 +6,10 @@
  */
 
 export { getEcsGroups } from './src/get_ecs_groups';
-export { getGroupByObject, getFormattedGroupBy } from './src/group_by_object_utils';
+export {
+  unflattenGrouping,
+  getFormattedGroups,
+  getFormattedGroupBy,
+  getGroupByObject,
+} from './src/group_by_object_utils';
 export type { Group, FieldsObject } from './src/types';

x-pack/platform/packages/shared/alerting-rule-utils/src/group_by_object_utils.test.ts

@@ -5,7 +5,51 @@
  * 2.0.
  */
 
-import { getFormattedGroupBy, getGroupByObject } from './group_by_object_utils';
+import {
+  getFormattedGroups,
+  unflattenGrouping,
+  getGroupByObject,
+  getFormattedGroupBy,
+} from './group_by_object_utils';
+
+describe('getFormattedGroups', () => {
+  it('should format groupBy correctly for empty input', () => {
+    expect(getFormattedGroups()).toBeUndefined();
+  });
+
+  it('should format groupBy correctly for multiple groups', () => {
+    expect(
+      getFormattedGroups({
+        'host.name': 'host-0',
+        'host.mac': '00-00-5E-00-53-23',
+        tags: 'event-0',
+        'container.name': 'container-name',
+      })
+    ).toEqual([
+      { field: 'host.name', value: 'host-0' },
+      { field: 'host.mac', value: '00-00-5E-00-53-23' },
+      { field: 'tags', value: 'event-0' },
+      { field: 'container.name', value: 'container-name' },
+    ]);
+  });
+});
+
+describe('unflattenGrouping', () => {
+  it('should return undefined when there is no grouping', () => {
+    expect(unflattenGrouping()).toBeUndefined();
+  });
+
+  it('should return an object containing groups for one groupBy field', () => {
+    expect(unflattenGrouping({ 'host.name': 'host-0' })).toEqual({ host: { name: 'host-0' } });
+  });
+
+  it('should return an object containing groups for multiple groupBy fields', () => {
+    expect(unflattenGrouping({ 'host.name': 'host-0', 'container.id': 'container-0' })).toEqual({
+      container: { id: 'container-0' },
+      host: { name: 'host-0' },
+    });
+  });
+});
 
 describe('getFormattedGroupBy', () => {
   it('should format groupBy correctly for empty input', () => {
@@ -53,10 +97,6 @@ describe('getFormattedGroupBy', () => {
 });
 
 describe('getGroupByObject', () => {
-  it('should return empty object for undefined groupBy', () => {
-    expect(getFormattedGroupBy(undefined, new Set<string>())).toEqual({});
-  });
-
   it('should return an object containing groups for one groupBy field', () => {
     expect(getGroupByObject('host.name', new Set(['host-0', 'host-1']))).toEqual({
       'host-0': { host: { name: 'host-0' } },

x-pack/platform/packages/shared/alerting-rule-utils/src/group_by_object_utils.ts

@@ -8,6 +8,8 @@
 import { unflattenObject } from '@kbn/object-utils';
 import { Group } from './types';
 
+// TODO: Remove after updating the group logic in the log threshold rule
+// https://github.com/elastic/kibana/issues/220006
 export const getGroupByObject = (
   groupBy: string | string[] | undefined,
   groupValueSet: Set<string>
@@ -28,6 +30,16 @@ export const getGroupByObject = (
   return groupKeyValueMappingsObject;
 };
 
+export const unflattenGrouping = (
+  grouping?: Record<string, string> | undefined
+): Record<string, any> | undefined => {
+  if (grouping) {
+    return unflattenObject(grouping);
+  }
+};
+
+// TODO: Remove after updating the group logic in the log threshold rule
+// https://github.com/elastic/kibana/issues/220006
 export const getFormattedGroupBy = (
   groupBy: string | string[] | undefined,
   groupSet: Set<string>
@@ -46,3 +58,14 @@ export const getFormattedGroupBy = (
   }
   return groupByKeysObjectMapping;
 };
+
+export const getFormattedGroups = (grouping?: Record<string, string>): Group[] | undefined => {
+  const groups: Group[] = [];
+  if (grouping) {
+    const groupKeys = Object.keys(grouping);
+    groupKeys.forEach((group) => {
+      groups.push({ field: group, value: grouping[group] });
+    });
+  }
+  return groups.length ? groups : undefined;
+};