[Event Log] add event.outcome to relevant event log documents (#64389) (

#64616)

resolves #61891

Adds a relatively new ECS field `event.outcome`. Value of `success`, `failure`,
or `unknown`. This is nice, as the only way we have currently of determining an
error for an alert or action execution in the log is the existence of an
`error.message` field.  It is added to to the documents for those events.

see: https://www.elastic.co/guide/en/ecs/current/ecs-event.html

x-pack/plugins/actions/server/lib/action_executor.ts

@@ -140,13 +140,18 @@ export class ActionExecutor {
       status: 'ok',
     };
 
+    event.event = event.event || {};
+
     if (result.status === 'ok') {
+      event.event.outcome = 'success';
       event.message = `action executed: ${actionLabel}`;
     } else if (result.status === 'error') {
+      event.event.outcome = 'failure';
       event.message = `action execution failure: ${actionLabel}`;
       event.error = event.error || {};
       event.error.message = actionErrorToMessage(result);
     } else {
+      event.event.outcome = 'failure';
       event.message = `action execution returned unexpected result: ${actionLabel}`;
       event.error = event.error || {};
       event.error.message = 'action execution returned unexpected result';

x-pack/plugins/alerting/server/task_runner/task_runner.test.ts

@@ -165,6 +165,7 @@ describe('Task Runner', () => {
       Object {
         "event": Object {
           "action": "execute",
+          "outcome": "success",
         },
         "kibana": Object {
           "saved_objects": Array [
@@ -226,6 +227,7 @@ describe('Task Runner', () => {
           Object {
             "event": Object {
               "action": "execute",
+              "outcome": "success",
             },
             "kibana": Object {
               "saved_objects": Array [
@@ -342,6 +344,7 @@ describe('Task Runner', () => {
           Object {
             "event": Object {
               "action": "execute",
+              "outcome": "success",
             },
             "kibana": Object {
               "saved_objects": Array [
@@ -558,6 +561,7 @@ describe('Task Runner', () => {
             },
             "event": Object {
               "action": "execute",
+              "outcome": "failure",
             },
             "kibana": Object {
               "saved_objects": Array [

x-pack/plugins/alerting/server/task_runner/task_runner.ts

@@ -202,12 +202,16 @@ export class TaskRunner {
       event.message = `alert execution failure: ${alertLabel}`;
       event.error = event.error || {};
       event.error.message = err.message;
+      event.event = event.event || {};
+      event.event.outcome = 'failure';
       eventLogger.logEvent(event);
       throw err;
     }
 
     eventLogger.stopTiming(event);
     event.message = `alert executed: ${alertLabel}`;
+    event.event = event.event || {};
+    event.event.outcome = 'success';
     eventLogger.logEvent(event);
 
     // Cleanup alert instances that are no longer scheduling actions to avoid over populating the alertInstances object

x-pack/plugins/event_log/generated/mappings.json

@@ -41,6 +41,10 @@
                 },
                 "end": {
                     "type": "date"
+                },
+                "outcome": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
                 }
             }
         },

x-pack/plugins/event_log/generated/schemas.ts

@@ -41,6 +41,7 @@ export const EventSchema = schema.maybe(
         start: ecsDate(),
         duration: ecsNumber(),
         end: ecsDate(),
+        outcome: ecsString(),
       })
     ),
     error: schema.maybe(

x-pack/plugins/event_log/scripts/mappings.js

@@ -53,6 +53,7 @@ exports.EcsEventLogProperties = [
   'event.start',
   'event.duration',
   'event.end',
+  'event.outcome', // optional, but one of failure, success, unknown
   'error.message',
   'user.name',
   'kibana.server_uuid',