[Alert Detail Page] Log threshold rule type

[katrin-freihofner]

Problem description

This view supports our users in troubleshooting log threshold alerts (incl. ratio alerts). The details page should contain information about:

• When did this symptom or issue start? What’s the situation and state now? How is it trending?
• Has this happened before, when, and how frequently?
• Is this alert scheduled to be muted? Was a notification sent to third party systems? (Note that the user may have seen an alert flyout for a specific alert, thus being "notified" via the UI as opposed to receiving a Slack or ServiceNow notification for example)
• Has a case been created for it? In other words, is this already being investigated elsewhere?

User journey

Design

https://github.com/elastic/observability-design/issues/266

Acceptance criteria

• alert details view consists of:
  • overview (header part)
  • main chart showing the log rate and the alert annotation
  • chart showing the log rate "history" with alert annotations
  • add a link to default message to make sure the user is able to navigate to the new alert details view

Open questions
Is there a way to show which entities (hosts, host groups) are affected?
https://discuss.elastic.co/t/rule-type-log-threshold/325436

Figma file

⚙️ Implementation tasks:

v8.8 🚀

• [AO] - Setup the scaffolding of the Log threshold Alert Details page (AlertDetailsAppSection component) #152738
• [AO] - Update the AlertSummary to show only the rule-specific fields #153095
• [AO] - Include the Alert's shared fields across the rule types PageTitle of the Alert Details page  #153103
• [AO] - Add the chart history to the Logs Alert Details page  #153565
• [AO] - Add the threshold expected and current value for Logs Alert Details page #153567
• [AO] - use the annotations and the calculation of the time range from observability-alert-details #154845
• [AO] - Add the rule specific fields to the Alert Summary #153675
• [AO] - Hide the additional explanatory text when executionTimeRange is passed  #153946
• [AO] - Add Logs Ratio chart to the Alert Details page #155022
• Charts are not displaying properly on Log Threshold Rule's alert detail page #155083
• [AO] - Activate the alertDetailsUrl action variable for Log threshold alert details page  #155053
• [AO] - Remove feature flag for the Log threshold Alert Detail Page  #153880 we will keep the alert details page behind the feature flag

v8.9 🔖

• [AO] - Add the flapping alert annotations to the history chart for Log threshold Alert details page #152741
• [AO] - Share the hook that fetches the alert annotations in the Alert Details page #154170
• https://github.com/elastic/actionable-observability/issues/17
• [AO] - Add functional and unit tests  #155025

Dependencies

• Add ALERT_CONTEXT to alert document for Log Threshold Rule #155484

[elasticmachine]

Pinging @elastic/actionable-observability (Team: Actionable Observability)

[fkanout]

Questions for the v8.8 MVP meeting:

• Will we use the old design or a new one, like the[ Metric threshold] (NEW)(https://www.figma.com/file/HTI4gmoxanw4No6DbLiIqp/Alert-details-vision?node-id=79-60585&t=AiPvl5n2QEbqbXo6-0)
• Are we going to follow the same approach, a chart-per-condition?
• From a representational perspective, is the preview chart bar ok?
• No history chart when we have multiple conditions?
• We have two auxiliary charts from the inventory rule type. Would that work?
  

MVP v8.8

• New design
• New header/ Alert Summary
• Source filed: Default log view + source context

Stretched goals

• History chart ONLY when having one condition
• No aux charts (Ongoing discussion)

[katrin-freihofner]

Moved to new issue https://github.com/elastic/actionable-observability/issues/47