[AO] Use a same format for threshold and value in APM Latency alert document #156255

📝 Summary

RFC Document

Currently, for the APM Latency threshold rule, the information for evaluation threshold and value are in 2 different formats. In this ticket, we need to see if there is a way to improve this situation and remove the extra code related to handling this case.

Here is an example of saved data in the alert document:

Challenge

• If we change this value in the alert document, then some documents have the new format and others the old one, which makes the data that we show in UI not consistent. We need to check if there is a way to use a consistent format for both fields safely.

Ideas

• Adding kibana.alert.evaluation.threshold.us field and maybe deprecating kibana.alert.evaluation.threshold
• Add a new revision
• Introduce the unit within the field in an object format
• Change the field value to microsecond and accept the fact that this value will not be correct for the previously recovered alerts

✅ Acceptance Criteria

• Threshold and value in the alert document should have the same unit for the APM Latency threshold