[Alerting] Add event log entry when an action starts executing

x-pack/plugins/actions/server/constants/event_log.ts

@@ -8,5 +8,6 @@
 export const EVENT_LOG_PROVIDER = 'actions';
 export const EVENT_LOG_ACTIONS = {
   execute: 'execute',
+  executeStart: 'execute-start',
   executeViaHttp: 'execute-via-http',
 };

x-pack/plugins/actions/server/lib/action_executor.test.ts

@@ -23,6 +23,7 @@ const services = actionsMock.createServices();
 const actionsClient = actionsClientMock.create();
 const encryptedSavedObjectsClient = encryptedSavedObjectsMock.createClient();
 const actionTypeRegistry = actionTypeRegistryMock.create();
+const eventLogger = eventLoggerMock.create();
 
 const executeParams = {
   actionId: '1',
@@ -42,7 +43,7 @@ actionExecutor.initialize({
   getActionsClientWithRequest,
   actionTypeRegistry,
   encryptedSavedObjectsClient,
-  eventLogger: eventLoggerMock.create(),
+  eventLogger,
   preconfiguredActions: [],
 });
 
@@ -379,6 +380,50 @@ test('logs a warning when alert executor returns invalid status', async () => {
   );
 });
 
+test('writes to event log for execute and execute start', async () => {
+  const executorMock = setupActionExecutorMock();
+  executorMock.mockResolvedValue({
+    actionId: '1',
+    status: 'ok',
+  });
+  await actionExecutor.execute(executeParams);
+  expect(eventLogger.logEvent).toHaveBeenCalledTimes(2);
+  expect(eventLogger.logEvent.mock.calls[0][0]).toMatchObject({
+    event: {
+      action: 'execute-start',
+    },
+    kibana: {
+      saved_objects: [
+        {
+          rel: 'primary',
+          type: 'action',
+          id: '1',
+          type_id: 'test',
+          namespace: 'some-namespace',
+        },
+      ],
+    },
+    message: 'action started: test:1: action-1',
+  });
+  expect(eventLogger.logEvent.mock.calls[1][0]).toMatchObject({
+    event: {
+      action: 'execute',
+    },
+    kibana: {
+      saved_objects: [
+        {
+          rel: 'primary',
+          type: 'action',
+          id: '1',
+          type_id: 'test',
+          namespace: 'some-namespace',
+        },
+      ],
+    },
+    message: 'action executed: test:1: action-1',
+  });
+});
+
 function setupActionExecutorMock() {
   const actionType: jest.Mocked<ActionType> = {
     id: 'test',

x-pack/plugins/actions/server/lib/action_executor.ts

@@ -7,6 +7,7 @@
 
 import type { PublicMethodsOf } from '@kbn/utility-types';
 import { Logger, KibanaRequest } from 'src/core/server';
+import { cloneDeep } from 'lodash';
 import { withSpan } from '@kbn/apm-utils';
 import { validateParams, validateConfig, validateSecrets } from './validate_with_schema';
 import {
@@ -155,6 +156,17 @@ export class ActionExecutor {
         };
 
         eventLogger.startTiming(event);
+
+        const startEvent = cloneDeep({
+          ...event,
+          event: {
+            ...event.event,
+            action: EVENT_LOG_ACTIONS.executeStart,
+          },
+          message: `action started: ${actionLabel}`,
+        });
+        eventLogger.logEvent(startEvent);
+
         let rawResult: ActionTypeExecutorResult<unknown>;
         try {
           rawResult = await actionType.executor({