[Security Solution][Detection Engine] Bubbles up errors when it cannot create signal documents

[FrankHassanabad]

Summary

Fixes: #77255, #63712

This bubbles up errors when we cannot correctly create signal documents. Before this PR, we sometimes would mark documents as being in the error state for the end user but ask them to look in their Kibana logs for the specific error. In some cases we did not bubble up any error states and the signal would look like it had 0 signals when that wasn't true. It had valid signals but could not write the signals to its index because the source index had incompatibilities with ECS and cannot write the document to the signals index.

This fixes those issues to correctly bubble up the errors. If you're interested in manual testing there are two ways. The first way is to take advantage of an existing "threshold bug" by making a "threshold rule" which has a CIDR in it like so below:

On output you should see that the threshold is in an error state for the rule and also additional details:

The second way to trigger this is to create a mock invalid ECS index with an invalid mapping in dev tools:

# This is invalid because it has an odd "original" inside of it
PUT mock-bad-ecs-index
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "message": {
        "properties": {
          "original": {
            "type": "text",
            "index": false,
            "doc_values": false
          }
        }
      }
    }
  }
}

# You might have to change your timestamp to be 5 minutes from now to catch it as a signal or use a really long look back time
PUT mock-bad-ecs-index/_doc/1
{
  "@timestamp": "2020-09-17T21:50:54.240Z",
  "message": {
    "original": "invalid subobject"
  }
}

Then create a rule against this index:

And you should see an error banner and error state where before it would not show the error message:

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[rylnd]

Thanks for the review instructions and the test coverage! Code reviewed, desk tested, and the release_note tag satisfies any documentation concerns. LGTM!

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 27ab5e1

Build metrics

✅ unchanged

History

• 💚 Build #75393 succeeded 7046c16
• 💚 Build #75327 succeeded 91315a1
• 💚 Build #75300 succeeded 041621f
• 💚 Build #75264 succeeded 1880725
• 💚 Build #75023 succeeded efea5be

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)