[Event Log] add event.outcome to relevant event log documents

resolves elastic#61891

Adds a relatively new ECS field `event.outcome`. Value of `success`, `failure`,
or `unknown`. This is nice, as the only way we have currently of determining an
error for an alert or action execution in the log is the existence of an
`error.message` field.  It is added to to the documents for those events.

see: https://www.elastic.co/guide/en/ecs/current/ecs-event.html

x-pack/plugins/actions/server/lib/action_executor.ts

@@ -138,13 +138,18 @@ export class ActionExecutor {
       status: 'ok',
     };
 
+    event.event = event.event || {};
+
     if (result.status === 'ok') {
+      event.event.outcome = 'success';
       event.message = `action executed: ${actionLabel}`;
     } else if (result.status === 'error') {
+      event.event.outcome = 'failure';
       event.message = `action execution failure: ${actionLabel}`;
       event.error = event.error || {};
       event.error.message = actionErrorToMessage(result);
     } else {
+      event.event.outcome = 'failure';
       event.message = `action execution returned unexpected result: ${actionLabel}`;
       event.error = event.error || {};
       event.error.message = 'action execution returned unexpected result';

x-pack/plugins/alerting/server/task_runner/task_runner.ts

@@ -202,12 +202,16 @@ export class TaskRunner {
       event.message = `alert execution failure: ${alertLabel}`;
       event.error = event.error || {};
       event.error.message = err.message;
+      event.event = event.event || {};
+      event.event.outcome = 'failure';
       eventLogger.logEvent(event);
       throw err;
     }
 
     eventLogger.stopTiming(event);
     event.message = `alert executed: ${alertLabel}`;
+    event.event = event.event || {};
+    event.event.outcome = 'success';
     eventLogger.logEvent(event);
 
     // Cleanup alert instances that are no longer scheduling actions to avoid over populating the alertInstances object

x-pack/plugins/event_log/generated/mappings.json

@@ -41,6 +41,10 @@
                 },
                 "end": {
                     "type": "date"
+                },
+                "outcome": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
                 }
             }
         },

x-pack/plugins/event_log/generated/schemas.ts

@@ -41,6 +41,7 @@ export const EventSchema = schema.maybe(
         start: ecsDate(),
         duration: ecsNumber(),
         end: ecsDate(),
+        outcome: ecsString(),
       })
     ),
     error: schema.maybe(

x-pack/plugins/event_log/scripts/mappings.js

@@ -53,6 +53,7 @@ exports.EcsEventLogProperties = [
   'event.start',
   'event.duration',
   'event.end',
+  'event.outcome', // optional, but one of failure, success, unknown
   'error.message',
   'user.name',
   'kibana.server_uuid',