[Screenshotting/Alerts] Support screenshots in alert content

[tsullivan]

Functional requirements:

• user is able to define an Alerting action for exporting a screenshot of a saved visualization
• when an alert triggers that has the screenshot action defined, the alert is delivered with the screenshot image embedded

Technical requirements:

• Users define screenshot actions in Management > Alerting > Actions
• The screenshot action uses the upcoming screenshot capture service, so no report artifact is created for the PNG/PDF

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[elasticmachine]

Pinging @elastic/kibana-reporting-services (Team:Reporting Services)

[pmuellr]

This sounds exciting! Not sure how this is actually going to work though.

Ideally we could have a connector "get image of visualization X", which you would arrange to create the image. Presumably persisted somewhere. But then if you want the image included in an email for the alert, we have problems:

• currently all actions are queued and will be run in an arbitrary order; so the "snapshot" action and say "email" action that wants to use the snapshot may be run out of order. We'd want the "snapshot" to run, and THEN the email to run. We don't have a way of doing that right now

• how do we communicate the image "name" or "data" that would be used in an email action link tag, between the "snapshot" action and "email" action? We have some ids that may be useful to compose an "id" that would be shared between them including rule id, alert id, execution id.

• are we including the image data in the email, or using a link?

We had done some previous investigation in this area, trying to find it, will link it when I do ...

[pmuellr]

hmmm ... I guess if we get a "snapshot" and "email/slack/etc" to somehow agree on what the "name" of the image will be, we can just wait for both connectors to run for it to be "eventually consistent". So if the email goes out before the image is available, maybe that's ok - it will "eventually" be available?

Actually, a good thing to check would be google imagine caching here. I believe they cache an image now when referenced in an email, so you can't really get "live updates" on a image that changes over time. Which isn't a problem in this case (I hope), but ... do they cache a 404 if the image isn't available "yet"?