[ES Query] Save ECS keyword group by fields in AAD document

[maryam-saeidi]

Related to #183220

Summary

This PR saves ECS keyword group by fields in AAD document for ES query rule.

Rule	Before	After

How to test

• Create some data with ECS fields
  • For example, you can use synthtrace command: node scripts/synthtrace simple_trace.ts --local --live
• Create an ES Query rule grouped by ECS and non-ECS fields
• In the generated alert, you should be able to see the ECS group by field but not the no-ECS ones

[obltmachine]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[maryam-saeidi]

/oblt-deploy

[doakalexi]

LGTM! I tested locally and works as expected

[pmuellr]

This code seems very dependent on string parsing of potential user data. What happens if one if the met terms includes ,? Feels like we should be using the values returned by the agg, instead of (I guess) parsing the result of us joining the values. Maybe this is something new we need to start returning that we aren't today?

The test for alertId !== UngroupedGroupId also seems a little sketchy, since an alertId could be UngroupedGroupId. Seems like this code would work fine today, but is unneeded, and could potentially cause problems in the future. Seems like you can just remove the alertId !== UngroupedGroupId check completely.

[maryam-saeidi]

@pmuellr I changed the implementation in this commit: da574d3

Is this good now?

[kibana-ci]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: b049cef

Failed CI Steps

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
triggersActionsUi	564	565	+1

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
triggersActionsUi	121.6KB	121.7KB	+127.0B

Unknown metric groups

API count

id	before	after	diff
triggersActionsUi	590	591	+1

History

• 💔 Build #229483 failed 17ccda1
• 💔 Build #229454 failed dba44ca
• 💔 Build #229391 failed f0840e2
• 💛 Build #229192 was flaky 1377672

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @maryam-saeidi

[doakalexi]

Tested the new changes locally, LGTM