[Alerting] Active alerts do not recover after re-enabling a rule

x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.test.ts

@@ -0,0 +1,210 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createAlertEventLogRecordObject } from './create_alert_event_log_record_object';
+import { UntypedNormalizedAlertType } from '../rule_type_registry';
+import { RecoveredActionGroup } from '../types';
+
+describe('createAlertEventLogRecordObject', () => {
+  const ruleType: jest.Mocked<UntypedNormalizedAlertType> = {
+    id: 'test',
+    name: 'My test alert',
+    actionGroups: [{ id: 'default', name: 'Default' }, RecoveredActionGroup],
+    defaultActionGroupId: 'default',
+    minimumLicenseRequired: 'basic',
+    isExportable: true,
+    recoveryActionGroup: RecoveredActionGroup,
+    executor: jest.fn(),
+    producer: 'alerts',
+  };
+
+  test('created alert event "execute-start"', async () => {
+    expect(
+      createAlertEventLogRecordObject({
+        ruleId: '1',
+        ruleType,
+        action: 'execute-start',
+        timestamp: '1970-01-01T00:00:00.000Z',
+        task: {
+          scheduled: '1970-01-01T00:00:00.000Z',
+          scheduleDelay: 0,
+        },
+        savedObjects: [
+          {
+            id: '1',
+            type: 'alert',
+            typeId: ruleType.id,
+            relation: 'primary',
+          },
+        ],
+      })
+    ).toStrictEqual({
+      '@timestamp': '1970-01-01T00:00:00.000Z',
+      event: {
+        action: 'execute-start',
+        category: ['alerts'],
+        kind: 'alert',
+      },
+      kibana: {
+        saved_objects: [
+          {
+            id: '1',
+            namespace: undefined,
+            rel: 'primary',
+            type: 'alert',
+            type_id: 'test',
+          },
+        ],
+        task: {
+          schedule_delay: 0,
+          scheduled: '1970-01-01T00:00:00.000Z',
+        },
+      },
+      rule: {
+        category: 'test',
+        id: '1',
+        license: 'basic',
+        ruleset: 'alerts',
+      },
+    });
+  });
+
+  test('created alert event "recovered-instance"', async () => {
+    expect(
+      createAlertEventLogRecordObject({
+        ruleId: '1',
+        ruleName: 'test name',
+        ruleType,
+        action: 'recovered-instance',
+        instanceId: 'test1',
+        group: 'group 1',
+        message: 'message text here',
+        namespace: 'default',
+        subgroup: 'subgroup value',
+        state: {
+          start: '1970-01-01T00:00:00.000Z',
+          end: '1970-01-01T00:05:00.000Z',
+          duration: 5,
+        },
+        savedObjects: [
+          {
+            id: '1',
+            type: 'alert',
+            typeId: ruleType.id,
+            relation: 'primary',
+          },
+        ],
+      })
+    ).toStrictEqual({
+      event: {
+        action: 'recovered-instance',
+        category: ['alerts'],
+        duration: 5,
+        end: '1970-01-01T00:05:00.000Z',
+        kind: 'alert',
+        start: '1970-01-01T00:00:00.000Z',
+      },
+      kibana: {
+        alerting: {
+          action_group_id: 'group 1',
+          action_subgroup: 'subgroup value',
+          instance_id: 'test1',
+        },
+        saved_objects: [
+          {
+            id: '1',
+            namespace: 'default',
+            rel: 'primary',
+            type: 'alert',
+            type_id: 'test',
+          },
+        ],
+      },
+      message: 'message text here',
+      rule: {
+        category: 'test',
+        id: '1',
+        license: 'basic',
+        ruleset: 'alerts',
+        name: 'test name',
+      },
+    });
+  });
+
+  test('created alert event "execute-action"', async () => {
+    expect(
+      createAlertEventLogRecordObject({
+        ruleId: '1',
+        ruleName: 'test name',
+        ruleType,
+        action: 'recovered-instance',
+        instanceId: 'test1',
+        group: 'group 1',
+        message: 'action execution start',
+        namespace: 'default',
+        subgroup: 'subgroup value',
+        state: {
+          start: '1970-01-01T00:00:00.000Z',
+          end: '1970-01-01T00:05:00.000Z',
+          duration: 5,
+        },
+        savedObjects: [
+          {
+            id: '1',
+            type: 'alert',
+            typeId: ruleType.id,
+            relation: 'primary',
+          },
+          {
+            id: '2',
+            type: 'action',
+            typeId: '.email',
+          },
+        ],
+      })
+    ).toStrictEqual({
+      event: {
+        action: 'recovered-instance',
+        category: ['alerts'],
+        duration: 5,
+        end: '1970-01-01T00:05:00.000Z',
+        kind: 'alert',
+        start: '1970-01-01T00:00:00.000Z',
+      },
+      kibana: {
+        alerting: {
+          action_group_id: 'group 1',
+          action_subgroup: 'subgroup value',
+          instance_id: 'test1',
+        },
+        saved_objects: [
+          {
+            id: '1',
+            namespace: 'default',
+            rel: 'primary',
+            type: 'alert',
+            type_id: 'test',
+          },
+          {
+            id: '2',
+            namespace: 'default',
+            type: 'action',
+            type_id: '.email',
+          },
+        ],
+      },
+      message: 'action execution start',
+      rule: {
+        category: 'test',
+        id: '1',
+        license: 'basic',
+        ruleset: 'alerts',
+        name: 'test name',
+      },
+    });
+  });
+});

x-pack/plugins/alerting/server/lib/create_alert_event_log_record_object.ts

@@ -0,0 +1,81 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { AlertInstanceState } from '../types';
+import { IEvent } from '../../../event_log/server';
+import { UntypedNormalizedAlertType } from '../rule_type_registry';
+
+export type Event = Exclude<IEvent, undefined>;
+
+interface CreateAlertEventLogRecordParams {
+  ruleId: string;
+  ruleType: UntypedNormalizedAlertType;
+  action: string;
+  ruleName?: string;
+  instanceId?: string;
+  message?: string;
+  state?: AlertInstanceState;
+  group?: string;
+  subgroup?: string;
+  namespace?: string;
+  timestamp?: string;
+  task?: {
+    scheduled?: string;
+    scheduleDelay?: number;
+  };
+  savedObjects: Array<{
+    type: string;
+    id: string;
+    typeId: string;
+    relation?: string;
+  }>;
+}
+
+export function createAlertEventLogRecordObject(params: CreateAlertEventLogRecordParams): Event {
+  const { ruleType, action, state, message, task, ruleId, group, subgroup, namespace } = params;
+  const alerting =
+    params.instanceId || group || subgroup
+      ? {
+          alerting: {
+            ...(params.instanceId ? { instance_id: params.instanceId } : {}),
+            ...(group ? { action_group_id: group } : {}),
+            ...(subgroup ? { action_subgroup: subgroup } : {}),
+          },
+        }
+      : undefined;
+  const event: Event = {
+    ...(params.timestamp ? { '@timestamp': params.timestamp } : {}),
+    event: {
+      action,
+      kind: 'alert',
+      category: [ruleType.producer],
+      ...(state?.start ? { start: state.start as string } : {}),
+      ...(state?.end ? { end: state.end as string } : {}),
+      ...(state?.duration !== undefined ? { duration: state.duration as number } : {}),
+    },
+    kibana: {
+      ...(alerting ? alerting : {}),
+      saved_objects: params.savedObjects.map((so) => ({
+        ...(so.relation ? { rel: so.relation } : {}),
+        type: so.type,
+        id: so.id,
+        type_id: so.typeId,
+        namespace,
+      })),
+      ...(task ? { task: { scheduled: task.scheduled, schedule_delay: task.scheduleDelay } } : {}),
+    },
+    ...(message ? { message } : {}),
+    rule: {
+      id: ruleId,
+      license: ruleType.minimumLicenseRequired,
+      category: ruleType.id,
+      ruleset: ruleType.producer,
+      ...(params.ruleName ? { name: params.ruleName } : {}),
+    },
+  };
+  return event;
+}

x-pack/plugins/alerting/server/plugin.ts

@@ -373,6 +373,7 @@ export class AlertingPlugin {
       eventLog: plugins.eventLog,
       kibanaVersion: this.kibanaVersion,
       authorization: alertingAuthorizationClientFactory,
+      eventLogger: this.eventLogger,
     });
 
     const getRulesClientWithRequest = (request: KibanaRequest) => {