Alerting: alert does not trigger when using a group by clause

[endorama]

Kibana version: 8.11.3

Elasticsearch version:

Server OS version:

Browser version:

Browser OS version:

Original install method (e.g. download page, yum, from source, etc.):

Describe the bug:

I discovered that the alert does not trigger when a group by clause is set in its settings. My alert was configured to use a runtime field (which was not selectable by the UI). I also tried with another (non runtime) field, selected through the UI with the same result.
In both cases the alert did not fire when the condition was met.
Removing the group by cause made the alert trigger as expected.

Steps to reproduce:

1. Create a Metric threshold alert
2. Set the condition to a Custom Equation. This is the condition I had this issue with:
   
3. Set the filter. This is the filter I used:
   
4. Change the Group alerts by (optional) to a field value. Condition is set to be evaluated every 1 minute.
5. Trigger the alert.

Expected behavior: The alert is fired per group as expected.

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:
Thank you!

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[elasticmachine]

Pinging @elastic/obs-ux-infra_services-team (Team:obs-ux-infra_services)

[elasticmachine]

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

[simianhacker]

Sorry for the noise on this issue, I mis-configured my settings under "Infra" and misread the preview chart.

It appears everything is working as expected:

Runtime fields are not supported by the Metric Threshold rule because we are not using a traditional Kibana DataViews for the index pattern. In order for the alert to trigger on a group by field, it must have values in the documents that are indexed. I just tested this out (see screenshot above) and everything is triggering as expected.

[endorama]

Hello @simianhacker, thank you! Are you aware if supporting runtime fields for filtering will be supported?

As a minor note it would be nice if the API would reject a runtime field instead of accepting it and then non working as expected from a user point of view, should I create a follow-up issue about this?

Thank you

[shahzad31]

Hello @simianhacker, thank you! Are you aware if supporting runtime fields for filtering will be supported?

As a minor note it would be nice if the API would reject a runtime field instead of accepting it and then non working as expected from a user point of view, should I create a follow-up issue about this?

Thank you

@endorama we have an issue here #173771