[Maps] Geo containment alert V1 completion tasks

[kindsun]

Following up on #76285, there are several issues we'll want to address that came of review and separate discussion. Most of these should be targeted for feature completeness of Geo Threshold Alerts V1 (i.e.- when the experimental flag comes off) however some may bleed over into V2.

The first 4 under Dev are roughly in the order they'll be tackled, the rest are open to shuffling:

Dev

• KQL filtering [Maps] Add KQL filtering to geo-threshold alerts #80683 (PR: [Maps] Add query bar inputs to geo threshold alerts tracked points & boundaries #80871)
• Generic crossing & leaving [Maps] Support exiting shapes and generic crossing condition #80686 (PR: [Maps] Add 'crossed' & 'exited' events to tracking alert  #82463)
• Fix issue resolving nested ES fields (PR: [Maps] Fix threshold alert issue resolving nested fields #83577)
• Containment option for tracking (alerts while contained or not contained)(PR: Add geo containment tracking alert type #84151)
• Evaluate how pauses affect data collection. How does disable/re-enable play out?~(Introduce geo-threshold alerts #76285 (review)) (PR: Geo containment alert sparsity handling: preserve active status for non-updated alerts #85364)
• Add data sparsity handling (preserve active status) (PR: Geo containment alert sparsity handling: preserve active status for non-updated alerts #85364)
• Only allow Gold+ usage, show disabled at lower license levels
  (Introduce geo-threshold alerts #76285 (review)) (Being handled by alerting team)
• Docs (PR: [Docs] Add geo threshold and containment docs #88783)
• Handle multiple shapes and alert once for each detected shape presence in interval (PR: [Maps] Geo containment latency and concurrent containment fix #86980)
• Repurpose threshold readme for containment (PR: Add readme to geo containment alert covering test alert setup #89625)
• Remove threshold alert (PR: Remove geo threshold alert type #89632)
• Remove feature flag making geo alerts experimental (PR: GA Geo containment alerts. Remove Geo containment alert experimental config settings and refs #90301)
• Add support for runtime fields (audited and closed)(Issue: [Maps][Alerting] Support runtime fields for containment alerts #89585)
• Update docs to focus on containment (PR: Update geo alerting docs to just cover geo containment #90480)

Phase 2 Catch-all (can be ported to new issue)

• Allow max vars to be configurable
• Communicate to user if any of the preset maxes have been hit Introduce geo-threshold alerts #76285 (review))
• API options?
• Auto-generated solutions layers for easier Alerts review and general visibility

Old tasks no longer relevant

- [ ] Consider looking at multiple crossings within interval window?
- [ ] Make crossing time a human readable timestamp instead of unix timestamp

Design

• New icon for alert (Introduce geo-threshold alerts #76285 (review))
• Rework the UI to show full configuration in preview where pop-ups are used (Introduce geo-threshold alerts #76285 (review))

cc @kmartastic @thomasneirynck @miukimiu @YulNaumenko

[elasticmachine]

Pinging @elastic/kibana-gis (Team:Geo)

[kmartastic]

• Add geo_shape tracking

Unless this is a simple task (like 10 lines of code or flipping a switch), I don't think we need to do this work for v.1 or v.2.

The list looks good @aaronjcaldwell.

[kindsun]

• Add geo_shape tracking

Unless this is a simple task (like 10 lines of code or flipping a switch), I don't think we need to do this work for v.1 or v.2.

The list looks good @aaronjcaldwell.

👍 Thanks @kmartastic! The query is easy (literally almost the same) but it requires a little more thought around UX and indexing content, like do we still provide lines connecting previous & current locations and if so do we connect centroids, etc. I think it's safe to drop it from this list and circle back on it as needed in a future version.

[mikecote]

Add readme for alert built-in

I recently merged a PR (#81526) that allows the alert flyout to link to the documentation. Once the docs are in, you can add the url here in the alert type model.

[thomasneirynck]

Before going GA with this, imho we should remove time-field from selection. details here: #83013

Selecting a time-field that is different from the time-field of the index-pattern creates unnecessary avenue for bugs and misconfigurations, and will hurt us long term when building other features on top of this (e.g. layer-templates etc..)

[thomasneirynck]

closed, v1 completed.