[event log] add rule type id in custom kibana.alerting field

[pmuellr]

We don't currently have the rule type id available in the event log docs, but this would be very useful for slicing / dicing the event log data during diagnosis. It is available embedded in the message field, so is there in a helpful way for humans looking at individual documents.

It would go in here, presumably as rule_type_id or such ...

kibana/x-pack/plugins/event_log/scripts/mappings.js

Lines 16 to 34 in e894ee9

	alerting: {
	properties: {
	instance_id: {
	type: 'keyword',
	ignore_above: 1024,
	},
	action_group_id: {
	type: 'keyword',
	ignore_above: 1024,
	},
	action_subgroup: {
	type: 'keyword',
	ignore_above: 1024,
	},
	status: {
	type: 'keyword',
	ignore_above: 1024,
	},
	},

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[pmuellr]

In addition to having a top-level rule type id in the document, we should also arrange to have a reference to the most relevant saved object available outside the current nested kibana.saved_objects property. Those fields work well for queries that support nested fields, but turns out most Kibana viz's do not.

And we should ensure that the same info for connectors is available in the same way - so you don't have to drill into nested properties (which you can't in Kibana viz's) to do searches/aggs on these values.