Simple, Singular Monitor Alerts

[andrewvc]

Is your feature request related to a problem? Please describe.

Alerting today generally performs a search that matches 1+ results, then sends out a single message summarizing everything that happened. Users have generally said that they prefer a single message instead.

Additionally, users complain that they can't access all fields they'd like to access. With multiple grouped alerts this is complex, with singular ones this is simple (just expose all the fields). So, this kills two birds with one stone.

Describe the solution you'd like

Users seem to want to get an alert per monitor. Right now alerts match groups of monitors and we send one message out summarizing that. We could switch to sending out individual alerts per, assuming something like elastic/kibana#68828 or elastic/kibana#50257 makes it into the alerting framework.

We need to find out if one of these solutions will make it before we proceed

Let's implement this by adding an option for grouped or individual alerts for exist alert types, where the new behavior is 'individual'. Let's also make it clear that grouped alerts are deprecated (for now). We could do this via a dropdown menu.

Describe alternatives you've considered

The metric threshold alert allows you to group based on arbitrary fields. This is nice, but should probably come from alerting itself

{{alertName}} - {{context.group}} is in a state of {{context.alertState}}

Reason:
{{context.reason}}

[justinkambic]

I am +1 on adding this enhancement; it's a request we've gotten from many different outlets. I also agree that field grouping seems like something that a lot of people are going to want, and it makes sense to maintain it as a feature of the Alerting API rather than hosting many similar but disparate implementations across solutions.

Given the amount of functionality we have added for alerting thus far, it seems to me like we are at a point where it would be wise to continue gathering feedback and following a more methodical strategy for future features.