[Alerting v2] Compose Discover: Rule authoring flyout with Discover Sandbox (planning draft)

[jasonrhodes]

FOR PLANNING ONLY, DO NOT MERGE

This draft PR shows a working prototype of the v2 rule authoring experience. It is intended to drive planning conversations and team review, not for production merge.

What this shows

A two-panel in-context rule authoring experience:

• Left — Discover Sandbox: Real ES|QL editor (CodeEditor + Lens histogram + EuiDataGrid) rendered as an EUI child flyout (size="fill") alongside the Edit Form.
• Right — Edit Form: A stepped flyout (session="start") with a custom minimal stepper. Steps: Alert Condition → Details & Artifacts → Notifications (Recovery Condition added in PR E).
• The prototype also shows the full tracking + split + recovery flow that will ship later.

PR breakdown

PR	Scope	Status	Depends on
#268739 — PR A	HorizontalMinimalStepper component + storybook	Open (draft)	—
PR B (#268774)	Stepped Edit Form (3 steps), RHF form migration, field groups, API wiring — single editor, no tracking/split	In progress	PR A
PR C	Discover Sandbox redesign — search row, keyboard shortcuts, single editor UX polish	Pending	PR B
PR D	YAML editing mode with round-trip sync	Pending	PR B
PR E	Custom recovery + tracking split — adds Recovery Condition step, tracking toggle, heuristic split, Sandbox tab bar	Pending	PR C
PR F	Split-query ES|QL autocomplete for alert/recovery block editors	Pending	PR E

PR C and PR D are independent and can be worked in parallel after PR B lands. PR E and PR F are the second wave.

Known gaps (pre-merge requirements across all PRs)

• RHF migration — form values (PR B)
• Discover Sandbox redesign — search row, keyboard shortcuts (PR C)
• YAML round-trip (PR D)
• Tracking mode + Recovery Condition + Sandbox tab bar (PR E)
• Split-query autocomplete (PR F)
• E2E / Scout tests
• Feature flag gating

How to run this locally

1. Start Elasticsearch

node scripts/es snapshot --license=trial --kibanaUrl http://localhost:5603/ifh

2. Start Kibana (Node 24 required)

export NVM_DIR="$HOME/.nvm" && source "$NVM_DIR/nvm.sh" && nvm use 24
KBN_USE_RSPACK=true yarn start \
  --server.port=5603 \
  --server.basePath=/ifh \
  --server.rewriteBasePath=true

config/kibana.dev.yml must contain:

xpack.alerting_v2.enabled: true
dev.basePathProxyTarget: 5604
mockIdpPlugin.enabled: false

3. Load test data

python3 - <<'EOF'
import json, random, urllib.request
from datetime import datetime, timedelta, timezone
from base64 import b64encode

ES = "http://localhost:9200"
AUTH = b64encode(b"elastic:changeme").decode()
H = {"Content-Type":"application/x-ndjson","Authorization":f"Basic {AUTH}"}
hosts = ["prod-web-01","prod-web-02","prod-app-01","prod-app-02","prod-db-01","prod-db-02","prod-worker-01"]
now = datetime.now(timezone.utc)
lines = []
for i in range(2000):
    ts = now - timedelta(hours=random.uniform(0, 6))
    host = random.choice(hosts)
    base_cpu = 0.85 if host in ("prod-db-01","prod-web-02") else random.uniform(0.3, 0.75)
    doc = {"@timestamp":ts.strftime("%Y-%m-%dT%H:%M:%S.000Z"),"host.name":host,"cpu":round(base_cpu+random.uniform(-0.05,0.1),2),"memory":round(random.uniform(0.4,0.9),2)}
    lines.append(json.dumps({"index":{"_index":"logs-infra-hosts"}}))
    lines.append(json.dumps(doc))
body = ("\n".join(lines)+"\n").encode()
r = urllib.request.Request(f"{ES}/_bulk",data=body,method="POST",headers=H)
with urllib.request.urlopen(r) as resp:
    result = json.loads(resp.read())
print(f"Seeded logs-infra-hosts: errors={result.get('errors')}")
EOF

4. Navigate

http://localhost:5603/ifh/app/management/alertingV2/rules

Click Create rule.

Sample rule

FROM logs-infra-hosts
| STATS avg_cpu = AVG(cpu) BY host.name
| WHERE avg_cpu > 0.8

Related

• [Alerting v2] Add HorizontalMinimalStepper component #268739 — PR A: HorizontalMinimalStepper (open draft)
• [Alerting v2] Compose Discover: stepped Edit Form flyout with RHF form state #268774 — PR B: Stepped Edit Form (in progress)
• [Alerting v2] Add quick edit rule flyout to the rules list #268164 — Quick Edit flyout (merged): field groups
• [Alerting v2] Form/YAML toggle for Discover flyout #265929 — YAML round-trip utilities (merged)
• [Alerting v2] MVP rule form, Split evaluation condition, and Recovery configuration #255876 — Split-query autocomplete prior art

[infra-vault-gh-plugin-prod]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!
• Click to trigger kibana-entity-store-performance-from-pr for this PR!
• Click to trigger kibana-storybooks-from-pr for this PR!