[Response Ops][Alerting] Alert Delete

[jcger]

Summary

Implements alert deletion feature (#208621). Can be found in stack management under Rules > Settings > Clean up

This PR is comprised of multiple sub-PRs:

UI and Kibana Endpoints

• Alert Delete UI package (rule settings + modal) - [Response Ops][Delete Alerts] UI Components Package #216334
• Preview (number of alerts that would be deleted with current settings) - [Response Ops][Alert Deletion] Affected alerts preview #216504
• Schedule deletion task - [Response Ops][Alert Deletion] Schedule Task #217226
• Last run task - [Response Ops][Alert Deletion] Last Run #219544

Alert Deletion Task

• Task definition - [Response Ops][Alerting] Alert deletion client to handle scheduling and previewing alert deletion task #216169
• Don't delete alerts linked to a case - [Response Ops][Alerting] Don't delete alerts linked to a case #216712

Final adjustments

• Max threshold up to 3 years, category_ids required, feature flag on and no alert deletion in o11y - [Response Ops][Alert Deletion] Final adjustments #219694
• Commit to fix broken task scheduling in the UI - 5b8cb87
• Functional test for happy path - [Response Ops][Alerting] Alert Delete functional test #221839
• Bugfixes + cases exception tooltip + singular thresholds -6dcd8a9

Release note

Added alert cleanup functionality to delete active or inactive (recovered, closed, or untracked) alerts with no status update for a period of time of at least one day

[ymao1]

Created a followup issue for deleting alerts linked to cases: #218137

[kibanamachine]

Cloud deployment initiated, see credentials at: https://buildkite.com/elastic/kibana-deploy-cloud-from-pr/builds/165

[cnasikas]

@elasticmachine merge upstream

[cnasikas]

I tested and LGTM! No code review as the code has already been reviewed in the previous PRs. Some topics for conversation:

• When there are no alerts to be deleted, everything is disabled, but it is not very clear why immediately. Should we show an informational callout instead to make it clearer why it is disabled?

• The autocompletion for the "Delete" input is on. Could we turn it on? I found it a bit annoying that it autocompletes on this input. autocomplete="off" should do the work.

• I noticed that the previous query is cached, so if I open the modal, delete some alerts, and then open the modal again, it says that it will delete X alerts, and then it disappears and says that there are no alerts to be deleted.

Screen.Recording.2025-06-06.at.3.39.49.PM.mov

[jcger]

• When there are no alerts to be deleted, everything is disabled, but it is not very clear why immediately. Should we show an informational callout instead to make it clearer why it is disabled?

Maybe a info tooltip stating that if the "delete" input and action button are disabled it might be because there are no alerts to delete with the current settings? What do you think, @joana-cps ?
⚠️ This is the only issue open but as it's not blocking I'll merge this feature branch when possible. Let's do whatever task comes out of here in another PR.

• The autocompletion for the "Delete" input is on. Could we turn it on? I found it a bit annoying that it autocompletes on this input. autocomplete="off" should do the work.

Done

• I noticed that the previous query is cached, so if I open the modal, delete some alerts, and then open the modal again, it says that it will delete X alerts, and then it disappears and says that there are no alerts to be deleted.

I added the "lastRun" param as part of the preview query key. This way, if data has been deleted it will disregard the previous cache data. I'm to scared to break something playing around now with stale and cache times

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 534b041
• Storybooks Preview
• Cloud Deployment

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
alerting	214	216	+2
apm	1921	1922	+1
cases	1020	1021	+1
discover	1306	1307	+1
embeddableAlertsTable	406	407	+1
infra	1467	1468	+1
ml	2405	2406	+1
monitoring	629	630	+1
observability	1303	1304	+1
securitySolution	7592	7593	+1
slo	1174	1175	+1
synthetics	1234	1235	+1
transform	692	693	+1
triggersActionsUi	862	874	+12
uptime	773	774	+1
total			+27

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/alerting-types	256	271	+15
@kbn/response-ops-alerts-delete	-	39	+39
alerting	872	877	+5
ruleRegistry	220	208	-12
triggersActionsUi	538	539	+1
total			+48

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
triggersActionsUi	1.5MB	1.5MB	+13.6KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
@kbn/core	882	883	+1
@kbn/response-ops-alerts-delete	-	1	+1
alerting	52	53	+1
triggersActionsUi	37	38	+1
total			+4

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
alerting	24.9KB	25.2KB	+270.0B
triggersActionsUi	111.6KB	111.8KB	+128.0B
total			+398.0B

Unknown metric groups

API count

id	before	after	diff
@kbn/alerting-types	260	275	+15
@kbn/response-ops-alerts-delete	-	39	+39
alerting	906	911	+5
ruleRegistry	258	246	-12
triggersActionsUi	544	545	+1
total			+48

async chunk count

id	before	after	diff
triggersActionsUi	56	57	+1

ESLint disabled in files

id	before	after	diff
@kbn/response-ops-alerts-delete	-	1	+1

ESLint disabled line counts

id	before	after	diff
@kbn/response-ops-alerts-delete	-	5	+5
@kbn/test-suites-xpack	661	665	+4
total			+9

References to deprecated APIs

id	before	after	diff
alerting	83	86	+3

Total ESLint disabled count

id	before	after	diff
@kbn/response-ops-alerts-delete	-	6	+6
@kbn/test-suites-xpack	682	686	+4
total			+10

History

• 💛 Build #306199 was flaky fc691ed
• 💚 Build #305760 succeeded 8060cf4
• 💛 Build #305372 was flaky 6dcd8a9
• 💛 Build #304712 was flaky b54ac3c
• 💚 Build #303804 succeeded ffd4268

cc @ymao1 @jcger

[kibanamachine]

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15533815693

[kibanamachine]

💔 All backports failed

Status	Branch	Result
❌	8.19	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 216613

Questions ?

Please refer to the Backport tool documentation

[jcger]

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

[cnasikas]

I added the "lastRun" param as part of the preview query key. This way, if data has been deleted it will disregard the previous cache data. I'm to scared to break something playing around now with stale and cache times

I was thinking something much simpler, like hiding the text or having a loading state while the query is being fetched behind the scenes.

[pmuellr]

Since this is hard to test locally, given the minimum age of alerts to be deleted is 1 day, I wrote a DevTools UBQ to "back date" existing alerts I have in the system by a day. This doesn't handle the kibana.alert.time_range field, but it doesn't appear it's used for alert deletion.

POST /.alerts-*/_update_by_query
{
  "script": {
    "source": """
      void backDate(def ctx, def fieldName) {
        def dateString = ctx._source[fieldName];
        if (dateString == null) return;
        def dateObject = ZonedDateTime.parse(dateString);
        def newDateObject = dateObject.minusDays(1);
        ctx._source[fieldName] = newDateObject;
      }

      backDate(ctx, '@timestamp');
      backDate(ctx, 'kibana.alert.start');
      backDate(ctx, 'kibana.alert.end');
    """,
    "lang": "painless"
  },
  "query": {
    "match_all": { }
  }
}