In #146403 we migrated all alert notification context links to use Discover's locator. For persisted data views we were also creating temporary data views, so these links were snapshots of the data view when the notification was triggered (data views could be changed between the creation of the context link and when the users opens the link). However this caused an issue that links can get very long that was partly resolved by #158582 reducing the spec of a data view be removing field counts (those are used to show popular fields in Discover's field list) .
We can further shorten this generated link by using just the id of the persisted data view, which makes adding the spec of the data view redundant. In this case, we need to inform the user that the given result might be different to the one that triggered the alert notification (there might be more fields, change of the index pattern, change of field formats). The disadvantage of increasing the likelihood of showing different data can be considered as a lower impact than a broken link because of a very long link due to a spec.
It could be extended like this:
Old:
Some documents might have been added or deleted
New:
Some documents might have been added or deleted or the underlying data view might have been changed
In #146403 we migrated all alert notification context links to use Discover's locator. For persisted data views we were also creating temporary data views, so these links were snapshots of the data view when the notification was triggered (data views could be changed between the creation of the context link and when the users opens the link). However this caused an issue that links can get very long that was partly resolved by #158582 reducing the spec of a data view be removing field counts (those are used to show popular fields in Discover's field list) .
We can further shorten this generated link by using just the id of the persisted data view, which makes adding the spec of the data view redundant. In this case, we need to inform the user that the given result might be different to the one that triggered the alert notification (there might be more fields, change of the index pattern, change of field formats). The disadvantage of increasing the likelihood of showing different data can be considered as a lower impact than a broken link because of a very long link due to a spec.
The message we need to extend is here: https://github.com/elastic/kibana/blob/503b466b72865433cfa0148409e982aa39bc2f40/src/plugins/discover/public/application/main/hooks/use_alert_results_toast.tsx#L20
It could be extended like this: Old:
Some documents might have been added or deleted
New:Some documents might have been added or deleted or the underlying data view might have been changed