[Custom threshold] Save the ECS group by fields at the AAD root level

[maryam-saeidi]

Related to #183220

Summary

This PR saves the ECS group by fields at the AAD root level.

Group by fields	AAD document

🧪 How to test

• Create a custom threshold rule with multiple groups (both ECS and non-ECS fields)
• Check the related AAD document; you should be able to see the ECS fields at the root level and not seeing non-ECS fields there
• Check the same information for the recovered alerts
• Rules without group by should work as before

[elasticmachine]

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

[obltmachine]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[dominiqueclarke]

My event.action is a different value on the nested field versus the root field

[maryam-saeidi]

My event.action is a different value on the nested field versus the root field

@dominiqueclarke Good catch! (I don't know how you found this case; I am glad that we are aware of it now. Thanks!)
I checked bolt-lite, and this field is something that is added by the alerting framework, so it will override the value that we are passing.
Do you think it should be handled differently? I feel like we can first focus on adding the fields that are not shared with the alerting framework and accept not having this field available for now, users can still filter it from kibana.alert.group if they want to. What do you think?

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 02f4210
• Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-188241-02f4210d5f9c
• Observability Deployment

Metrics [docs]

✅ unchanged

History

• 💛 Build #221176 was flaky 328ad04

cc @maryam-saeidi

[dominiqueclarke]

LGTM!