[AAD] Add kibana.alert.grouping field to ES Query rule

[cesco-f]

This PR closes #224889

How to test

1. Create a KQL rule that is grouped by one or more fields and trigger an alert.
2. Create a Query DSL rule that is not grouped and trigger an alert.
3. Create an ESQL rule that is not grouped and trigger an alert.
4. In the generated alert documents, verify that the kibana.grouping.* fields are present only for the KQL alert and absent for the Query DSL / ESQL alerts.
5. Recover the KQL alert and confirm that the kibana.grouping.* fields remain in the recovered alert document.
6. Inspect the index mappings and ensure the dynamic mapping for kibana.grouping.* has been applied correctly.
7. Confirm that the alert context still contains the grouping information.

Screen.Recording.2025-07-21.at.09.22.25.mov

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 9e12f9e

Failed CI Steps

• FTR Configs #131

Test Failures

• [job] [logs] FTR Configs #131 / serverless observability UI Onboarding Onboarding Auto-Detect guides user through data onboarding

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/alerting-rule-utils	17	19	+2

Unknown metric groups

API count

id	before	after	diff
@kbn/alerting-rule-utils	17	19	+2

History

• 💚 Build #322420 succeeded 32e4c4b
• 💚 Build #322192 succeeded 3ed8995
• 💔 Build #321188 failed 3f40152

[ersin-erdal]

Thanks for removing this, looks like wasn't used anywhere!

[ersin-erdal]

LGTM
Works as expected.
Mapping also looks correct.

  "grouping": {
    "dynamic": "true",
    "properties": {
      "host": {
        "properties": {
          "name": {
            "type": "keyword",
            "ignore_above": 1024
          }
        }
      }
    }
  },

[benakansara]

Tested with KQL, DSL, ESQL query types with and without group by fields. LGTM!

Great job! 👏