Onboard Log Threshold rule type with FAAD

[doakalexi]

Towards: #169867

This PR onboards Log Threshold rule type with FAAD.

To verify

Create a log threshold rule.
Example:

POST kbn:/api/alerting/rule
{
  "params": {
    "logView": {
      "logViewId": "Default",
      "type": "log-view-reference"
    },
    "timeSize": 5,
    "timeUnit": "m",
    "count": {
      "value": -1,
      "comparator": "more than"
    },
    "criteria": [
      {
        "field": "log.level",
        "comparator": "equals",
        "value": "error"
      }
    ]
  },
  "consumer": "alerts",
  "schedule": {
    "interval": "1m"
  },
  "tags": [],
  "name": "test",
  "rule_type_id": "logs.alert.document.count",
  "notify_when": "onActionGroupChange",
  "actions": []
}

Your rule should create an alert and should saved it in .internal.alerts-observability.metrics.alerts-default-000001
Example:

GET .internal.alerts-*/_search

Then set count.value: 75

The alert should be recovered and the AAD in the above index should be updated kibana.alert.status: recovered.

[doakalexi]

/ci

[doakalexi]

/ci

[doakalexi]

/ci

[doakalexi]

/ci

[doakalexi]

/ci

[doakalexi]

/ci

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[maryam-saeidi]

Functionality-wise, I tested creating an alert and recovering it + notification, also exceeding the limit for number of alerts that are generated and everything seemed as expected! 💪🏻

Code-wise, I rely on ResponseOps team review :)

[ymao1]

LGTM!

[js-jankisalvi]

Followed the as mentioned. Working as expected 👍 🎉

[tonyghiani]

LGTM!

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 3be157e

Metrics [docs]

Unknown metric groups

References to deprecated APIs

id	before	after	diff
infra	7	4	-3

History

• 💔 Build #199207 failed 7613c22
• 💔 Build #199190 failed 48457f2
• 💔 Build #199170 failed f761f47
• 💚 Build #198961 succeeded d238ce0
• 💚 Build #198773 succeeded b51dc38
• 💚 Build #198320 succeeded b46b8ba

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @doakalexi