[Event Log] Fixing call to update index alias to hidden

[ymao1]

Resolves #121298

Summary

When upgrading from <= 7.15 versions of Kibana, the event log will try to update existing event log indices to hidden. Part of this process involves setting existing index aliases to is_hidden. It turns out if you have one alias pointing to multiple indices, we need to update the alias settings in a single command instead of consecutive commands as we were doing previously.

For example, if our 7.15 event log aliases look like this:

{
	".kibana-event-log-7.15.2-000003": {
		"aliases": {
			".kibana-event-log-7.15.2": {
				"is_write_index": true
			}
		}
	},
	".kibana-event-log-7.15.2-000002": {
		"aliases": {
			".kibana-event-log-7.15.2": {
				"is_write_index": false
			}
		}
	},
	".kibana-event-log-7.15.2-000001": {
		"aliases": {
			".kibana-event-log-7.15.2": {
				"is_write_index": false
			}
		}
	}
}

Previously, we were issuing 3 calls to the update alias API, each one looking like this:

{
	actions: [{
		add: {
			index: <indexName>,
			alias: '.kibana-event-log-7.15.2',
			is_hidden: true,
		},
	}, ],
}

We actually need to be issuing 1 call to the update alias API that looks like this:

{
	"actions": [{
			"add": {
				"is_write_index": false,
				"index": ".kibana-event-log-7.15.2-000002",
				"alias": ".kibana-event-log-7.15.2",
				"is_hidden": true
			}
		},
		{
			"add": {
				"is_write_index": true,
				"index": ".kibana-event-log-7.15.2-000003",
				"alias": ".kibana-event-log-7.15.2",
				"is_hidden": true
			}
		},
		{
			"add": {
				"is_write_index": false,
				"index": ".kibana-event-log-7.15.2-000001",
				"alias": ".kibana-event-log-7.15.2",
				"is_hidden": true
			}
		}
	]
}

This PR updates to do this correctly.

To Verify

1. Change the Event log ILM policy to max_docs: 1 (to get ILM to roll over faster). Run 7.15 (or previous version) and let some rules/actions run to generate some event log docs and get multiple event log indices.
2. Run main using the previous data and notice that there is an error in the logs when updating the index aliases that cause the aliases not to get updated to hidden.
3. Run this branch using the previous data and notice no errors in the logs that verify that the index aliases are all updated to hidden.

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[mikecote]

Changes LGTM! I was able to reproduce the bug on main and confirmed it going away with this PR 👍

[ymao1]

@elasticmachine merge upstream

[pmuellr]

LGTM; this was more complicated than I expected - I thought we just needed an await before all the asyncForEach() that got added a while back! This is probably a better approach though, get them all done in one call.

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: b363eed
• Storybooks Preview

Metrics [docs]

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
eventLog	5	6	+1
kibana	957	956	-1
total			-0

History

• 💚 Build #17292 succeeded 97e3961
• 💔 Build #17284 failed f687bd6
• 💚 Build #17100 succeeded 265bc66

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @ymao1

[kibanamachine]

💔 All backports failed

Status	Branch	Result
❌	8.0	Backport failed because of merge conflicts You might need to backport the following PRs to 8.0: - Add migration support to the event log (#58010) - Increase stability when initializing the Elasticsearch index for the event log (#57465) - Adds event log for actions and alerting (#45081)
❌	7.17	Backport failed because of merge conflicts

How to fix

Re-run the backport manually:

node scripts/backport --pr 122882

Questions ?

Please refer to the Backport tool documentation