[Infrastructure UI][Rules] Specify recovery context for Inventory Threshold rule type

[ymao1]

The alerting framework has recently merged a PR to provide rule executors with the ability to specify context for recovered alerts. Details are available in the PR and in the alerting README but essentially,

1. Rule types should set doesSetRecoveryContext to true on the rule type. This allows context variables to appear in the action variable list in the UI for the recovered action group.
2. Inside the rule executor, when the executor has finished scheduling actions for active alerts, the following code should be added:

// Call done() to gain access to recovery utils
// If `doesSetRecoveryContext` is set to `false`, getRecoveredAlerts() returns an empty list
const { getRecoveredAlerts } = alertsFactory.done();

for (const alert of getRecoveredAlerts()) {
	const alertId = alert.getId();
	alert.setContext({
		CONTEXT HERE!
	})
}

Note that currently, we expect the recovered context to match the existing typing for context variables on the rule.

[elasticmachine]

Pinging @elastic/infra-monitoring-ui (Team:Infra Monitoring UI)

[simianhacker]

@ymao1 Is there a way to get the previous alert action group. For example, with the Metric Threshold alerts, there are 2 action groups: metric.threshold.fired and metric.threshold.warning. Eventually, I would like to add a third for NO DATA. One of the variables for the context is reason which should probably be tailored to the why it's recovered. For example, if we previously trigger a metric.threshold.warn or metric.threshold.fired then we would want to construct a reason message like CPU Usage for host-01 has recovered. Current value is {{value}}. But if it was a "NO DATA" alert (which we are going to add metric.thresold.nodata) we would want to have Data for host-01 is now available.

[ymao1]

@simianhacker Yes there is! We keep track of this in the lastScheduledActions on the alert

For recovered alerts you can do something like this:

const { getRecoveredAlerts } = services.alertFactory.done();
for (const alert of getRecoveredAlerts()) {
  const lastScheduledActionGroup = alert.getLastScheduledActions().group;
}

where lastScheduledActions looks like:

{
    group: <action group id>
    date: iso string representing the date the action was scheduled.
}

Does that work for your use case?

[simianhacker]

@ymao1 Yes it does, thank you ❤️

[nugroho-exp]

HI @simianhacker, I have Kibana v8.3.2 but recovery context is still empty. Looking at the merge date it seems
it is merged just after 8.3.0 branch is created. Would it be possible to backport it to 8.3.x? Thank you.