[event log] add rule to event log shared object for provider: actions action: execute log event

[pmuellr]

Currently, we do not add the rule saved object in the saved object references when we write the provider: actions, action: execute log entry. We do for provider: alerting, action: execute-action, which is logged when actions are queued to be run.

Historically, we weren't passing the rule into the action executor, so we didn't have the rule info to write out. That changed with RBAC, and we now have the rule when executing the action, so we should be able to provide that reference now.

This is fairly important to be able to track an action execution error to not just the connector that failed, but the alert it was run for.

Note: I could swear there was already an issue open for this, but not seeing it. We can close one as a DUP if someone else finds it.

The code where this would go, is here:

kibana/x-pack/plugins/actions/server/lib/action_executor.ts

Lines 124 to 136 in 886295f

	const event: IEvent = {
	event: { action: EVENT_LOG_ACTIONS.execute },
	kibana: {
	saved_objects: [
	{
	rel: SAVED_OBJECT_REL_PRIMARY,
	type: 'action',
	id: actionId,
	...namespace,
	},
	],
	},
	};

We'll have to figure out if we want the rel: SAVED_OBJECT_REL_PRIMARY on this - I think we do. This field indicates whether the event log doc will be returned when searching on just the alert SO. For the execute-action log, I believe we only use REL_PRIMARY for the rule, and not connector, because we don't want to expose what alerts are being run if you happen to just have a connector id to search for. Here's where that is done:

kibana/x-pack/plugins/alerting/server/task_runner/create_execution_handler.ts

Lines 175 to 188 in 886295f

	const event: IEvent = {
	event: { action: EVENT_LOG_ACTIONS.executeAction },
	kibana: {
	alerting: {
	instance_id: alertInstanceId,
	action_group_id: actionGroup,
	action_subgroup: actionSubgroup,
	},
	saved_objects: [
	{ rel: SAVED_OBJECT_REL_PRIMARY, type: 'alert', id: alertId, ...namespace },
	{ type: 'action', id: action.id, ...namespace },
	],
	},
	};

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)