[o11y alerting] Removing alerts group buttons

[emma-raffenne]

After brainstorm and user activity analysis with @katrin-freihofner we decided to remove the group button from Alerts list view.

They are causing confusion and are in Primary action / CTA style, it takes user attention and suggests to click on it, and in fullstory videos we observe that our users after loading empty list of alerts are clicking through these 3 buttons trying to find an alert. The list of All alerts is showing 0 results, but user still clicks on Active to check if there is any, so it's not intuitive, that Active button is showing just a subset / filter to the alert list.

Also we have added "Active now" metric on top of alerts list, so now it's a duplicate.

Also security alerts list got rig of this solution some time ago, and Alert status is presented as a dedicated dropdown control:

[elasticmachine]

Pinging @elastic/actionable-observability (Team: Actionable Observability)

[maryam-saeidi]

Isn't it a duplicate for this ticket? https://github.com/elastic/kibana/issues/143561

[maciejforcone]

oh yes, looks like it is, sorry for confusion.

[maryam-saeidi]

Closed as it is duplicated

[katrin-freihofner]

These are two different things to me. One is removing the button group, the other one is moving the functionality to a dropdown.

I suggest we only remove the button group for now (we currently don't have any indication that this is needed).

[maryam-saeidi]

@katrin-freihofner I remember a request internally about also adding rule types as a filter, so if we use controls, we can add multiple filters (status, rule category, ...) based on what we know can be useful for the user.

I also saw your comment here, which is a nice option, but not sure how easily it can be implemented.

So we have three options:

1. Removing the status filter (easiest)
2. Using control for status filter and possibly having rule category filter (I need to check the data view permission for this one)
3. Implementing filter for values in the table (Need to align with @XavierM and ResponseOps team)

So @katrin-freihofner and @maciejforcone, do you have enough information to decide, or do you need input regarding how much time is needed to implement each option?

[katrin-freihofner]

@maryam-saeidi I think we should go with

1. Removing the status filter (easiest)

and start talking to the responseOps team to learn more about the effort needed to improve the alert table UX (your point 3)

[maryam-saeidi]

@katrin-freihofner Just one point, since this component is also used in APM (PR), do we need to align with them? (They also had this filter even before adding the search bar)

[katrin-freihofner]

@maryam-saeidi yes, good point. I will reach out.

[katrin-freihofner]

Folks from both, Infra and APM are okay with the changes.

[maryam-saeidi]

Cool, so I reopen this one and close the other one.