[Alerting v2] MVP Dedicated rule form

[dominiqueclarke]

Summary

Resolves #251333

ℹ️ This PR is going into the alerting_v2 feature branch, not main, for the purposes of quick iteration. Feedback is welcome (and encouraged!) from the @elastic/kibana-data-discovery team but the work may not represent what is eventually merged into main.

This PR adds a dedicated ES|QL query editor and enhances the @kbn/alerting-v2-rule-form package with several new features for creating and editing v2 alerting rules. In particular, it sets up boilerplate for using the alerting v2 rule form components for a dedicated alerting experience.

⚠️ The design of these components should not be considered final. Indeed, work is still ongoing on finalized UX. The components present allow for making progress on the overall UI logic of the form without being blocked by design.

Key Changes

ES|QL Query Editor

• EsqlEditorField: A generic ES|QL editor field component using ESQLLangEditor with full syntax highlighting, autocomplete, and real-time validation
• EvaluationQueryField: A specific implementation for the evaluation.query.base field with ES|QL validation
• QueryFieldGroup: Field group wrapper for query-related fields (will eventually contain condition and also test query features)

Form Enhancements

• includeQueryEditor prop: Controls whether the ES|QL query editor is shown in RuleForm (default: true). Set to false for DynamicRuleForm where the query is controlled externally (e.g., Discover integration)
• includeYaml prop: Enables a Form/YAML toggle to switch between structured form UI and raw YAML editing
• includeSubmission prop: When true, the form renders submit/cancel buttons and handles rule creation internally via useCreateRule
• EditModeToggle: New component for switching between Form and YAML editing modes

Architecture Improvements

• Form now internally manages QueryClientProvider for react-query hooks
• Centralized RULE_FORM_ID constant - consumers no longer need to provide form ID
• Enhanced ErrorCallOut to extract validation errors from nested field paths (e.g., evaluation.query.base)

Usage Examples

Standalone form with all features (Create Rule Page):

<StandaloneRuleForm
  query={initialQuery}
  services={services}
  includeYaml           // Enable Form/YAML toggle
  includeSubmission     // Form handles API call internally
  onSuccess={onSuccess}
  onCancel={onCancel}
/>

Dynamic form for Discover integration:

<DynamicRuleForm
  query={externalQuery}  // Query controlled externally
  services={services}
  onSubmit={handleSubmit}
/>

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Risk	Severity	Mitigation
ES|QL editor dependency on @kbn/esql	Low	Uses existing stable package APIs
Form validation timing with nested fields	Low	Added explicit handling for undefined values and improved error extraction

Release Note

skip

[dominiqueclarke]

I don't think this needs to be passed as a prop. It can just be internal logic as part of the form. Will make the change shortly.

[dominiqueclarke]

This is essentially Dima's original yaml rule form just moved into this package.

[dominiqueclarke]

This was brought over from the default query in Dima's yaml form. Probably should disappear now.

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: b2e284f
• Storybooks Preview

Failed CI Steps

• Linting
• Check Types
• Jest Integration Tests #12
• Jest Integration Tests #12
• Post-Build

Test Failures

• [job] [logs] Jest Integration Tests #12 / DispatcherService integration tests when alert episodes have user actions (ack, snooze, deactivate) should dispatch fire actions for non-suppressed episodes and suppress actions for suppressed ones
• [job] [logs] Jest Integration Tests #12 / DispatcherService integration tests when alert episodes have user actions (ack, snooze, deactivate) should dispatch fire actions for non-suppressed episodes and suppress actions for suppressed ones
• [job] [logs] Jest Integration Tests #12 / DispatcherService integration tests when some episodes already have fires should only dispatch the new events
• [job] [logs] Jest Integration Tests #12 / DispatcherService integration tests when some episodes already have fires should only dispatch the new events

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [60d2b9f]

History

• 💔 Build #403970 failed 46fd667
• 💔 Build #403957 failed bf6f1ce
• 💔 Build #403211 failed e9b4791
• 💔 Build #403177 failed fe5065d

[elasticmachine]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!
• Click to trigger kibana-entity-store-performance-from-pr for this PR!
• Click to trigger kibana-storybooks-from-pr for this PR!