There are insufficient functional tests for runtime field support in Stack Rules

[pmuellr]

Edit: @ymao1 has confirmed runtime fields seem to work fine in Stack Rules out of the box, but we don't have any functional tests around this.
We should add some proper end-to-end tests verifying that this support doesn't unexpectedly break.

---

A Kibana dev just asked if runtime fields can be used in alerts. We'll have to check each alert to find out if they support runtime fields the way you would expect them to. For the alerting team, we should at least check out the index threshold, elasticsearch query, and geo containment alerts.

For example, for the index threshold alert, the field being compared to the threshold, and the grouping field, should both be able to use a runtime field (numeric and keyword typed, respectively).

I'm a little worried that while the executor functions don't really care whether a field is a runtime field or not, some of the alert validation DOES care (checks the types). If there's some failure, I'd expect it to be there. But we'd also want to make sure the aggregations we're doing with these fields also works as expected.

We should probably add some functional tests for this ...

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[ymao1]

I looked at how the index threshold rule and the ES query rule handled runtime fields for this issue. Details are in that issue, but the tldr is that the rules had no issues using the runtime fields but if, for whatever reason, the mapping changed to an incompatible type or was deleted, the rule would start throwing errors. There are a few follow-up issues that I created that are linked from that issue as well.

[pmuellr]

Ah cool - sorry, I shoulda looked that one up before creating this.

So we can close this?

[ymao1]

We can close it unless you think it makes sense to turn this issue into adding functional tests for this?

[mikecote]

We can close it unless you think it makes sense to turn this issue into adding functional tests for this?

Yeah, I think we can use this issue to add functional tests.