Let summary alert emit no action if message is empty

[parkertimmins]

When using summary alerts, it is useful to not emit actions if there are only ongoing alerts. Ongoing alerts can be filtered out using the If alert matches a query feature, but doing so will lead to a second problem: If we wish to alert All recovered when there are no remaining new or ongoing alerts, we cannot filter out the ongoing alerts using a query as this can give the incorrect impression that there are no ongoing alerts.

A solution is to instead use conditional logic in the message's template to return an empty message if there are no new alerts. If actions with empty messages are not sent to the connector, this provides a way to not alert if there are only ongoing alerts.

For example, the following message template is a use case. It would return an empty string if there are only ongoing alerts. If there are new alerts, it will print the new alerts. If there are no new or ongoing alerts, it will print All recovered:

{{#alerts.new.count}}
    {{rule.name}} is active with {{alerts.new.count}} new alerts:
    {{#alerts.new.data}}    
        < ... message for new alert ... >
    {{/alerts.new.data}}
{{/alerts.new.count}}
{{^alerts.new.data}}
{{^alerts.ongoing.data}}
    All recovered
{{/alerts.ongoing.data}}
{{/alerts.new.data}}

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[pmuellr]

I don't this kind of processing is going to be possible. First, there is currently no "general" message field in connectors. Second, an empty string may be valid or invalid across different connectors.

From other discussions, it was mentioned that we could add some kind of filtering on data in the summary alerts, like we do for non-summary alerts with if alert matches a query. I'm expecting an issue to get opened on that ...

[parkertimmins]

That makes sense that this won't work for the describe reasons ... also, it's kind of a hacky solution. But yes, https://github.com/elastic/kibana/issues/198161 will solve this problem in a better way. I'll go ahead and close this ticket.