[MySQL] Add alerting rule templates

packages/mysql/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.29.0"
+  changes:
+    - description: Add initial alert rule templates.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/15418
 - version: "1.28.1"
   changes:
     - description: Update MySQL Integration documentation with the required privileges.

packages/mysql/data_stream/slowlog/elasticsearch/ingest_pipeline/default.json

@@ -41,6 +41,13 @@
         "description": "Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document."
       }
     },
+    {
+      "remove": {
+        "field": "message",
+        "if": "ctx.event?.original != null",
+        "ignore_missing": true
+      }
+    },
     {
       "script": {
         "lang": "painless",

packages/mysql/kibana/alerting_rule_template/mysql-galera-cluster-state.json

@@ -0,0 +1,37 @@
+{
+  "id": "mysql-galera-cluster-state",
+  "type": "alerting_rule_template",
+  "attributes": {
+    "name": "MySQL Galera Cluster State",
+    "tags": ["mysql", "galera"],
+    "ruleTypeId": ".es-query",
+    "schedule": {
+      "interval": "1m"
+    },
+    "params": {
+      "searchType": "esqlQuery",
+      "timeWindowSize": 15,
+      "timeWindowUnit": "m",
+      "threshold": [
+        0
+      ],
+      "thresholdComparator": ">",
+      "size": 100,
+      "esqlQuery": {
+        "esql": "FROM metrics-mysql.galera_status-default\n| STATS statuses = VALUES(mysql.galera_status.connected) BY host.name\n| WHERE \"ON\" != statuses"
+      },
+      "aggType": "count",
+      "groupBy": "all",
+      "termSize": 5,
+      "sourceFields": [],
+      "timeField": "@timestamp",
+      "excludeHitsFromPreviousRun": true
+    },
+    "alertDelay": {
+      "active": 1
+    }
+  },
+  "managed": true,
+  "coreMigrationVersion": "8.8.0",
+  "typeMigrationVersion": "10.1.0"
+}

packages/mysql/kibana/alerting_rule_template/mysql-replication-lag.json

@@ -0,0 +1,37 @@
+{
+  "id": "mysql-replication-lag",
+  "type": "alerting_rule_template",
+  "attributes": {
+    "name": "MySQL Replication Lag",
+    "tags": ["mysql", "replication"],
+    "ruleTypeId": ".es-query",
+    "schedule": {
+      "interval": "1m"
+    },
+    "params": {
+      "searchType": "esqlQuery",
+      "timeWindowSize": 15,
+      "timeWindowUnit": "m",
+      "threshold": [
+        0
+      ],
+      "thresholdComparator": ">",
+      "size": 100,
+      "esqlQuery": {
+        "esql": "FROM metrics-mysql.replica_status-default\n| STATS secondsbehind=max(mysql.replica_status.seconds_behind_source) by host.name, mysql.replica_status.channel.name\n| WHERE secondsbehind > 10"
+      },
+      "aggType": "count",
+      "groupBy": "all",
+      "termSize": 5,
+      "sourceFields": [],
+      "timeField": "@timestamp",
+      "excludeHitsFromPreviousRun": true
+    },
+    "alertDelay": {
+      "active": 1
+    }
+  },
+  "managed": true,
+  "coreMigrationVersion": "8.8.0",
+  "typeMigrationVersion": "10.1.0"
+}

packages/mysql/kibana/alerting_rule_template/mysql-slow-queries.json

@@ -0,0 +1,37 @@
+{
+  "id": "mysql-slow-queries",
+  "type": "alerting_rule_template",
+  "attributes": {
+    "name": "MySQL Slow Queries P95 Latency",
+    "tags": ["mysql", "query"],
+    "ruleTypeId": ".es-query",
+    "schedule": {
+      "interval": "1m"
+    },
+    "params": {
+      "searchType": "esqlQuery",
+      "timeWindowSize": 15,
+      "timeWindowUnit": "m",
+      "threshold": [
+        0
+      ],
+      "thresholdComparator": ">",
+      "size": 100,
+      "esqlQuery": {
+        "esql": "FROM metrics-mysql.performance-default\n| STATS p95_ms = max(mysql.performance.events_statements.quantile.95/1e6) BY host.name, mysql.performance.events_statements.query_id, mysql.performance.events_statements.schemanamen\n| WHERE p95_ms > 500"
+      },
+      "aggType": "count",
+      "groupBy": "all",
+      "termSize": 5,
+      "sourceFields": [],
+      "timeField": "@timestamp",
+      "excludeHitsFromPreviousRun": true
+    },
+    "alertDelay": {
+      "active": 1
+    }
+  },
+  "managed": true,
+  "coreMigrationVersion": "8.8.0",
+  "typeMigrationVersion": "10.1.0"
+}

packages/mysql/manifest.yml

@@ -1,7 +1,7 @@
-format_version: "3.0.2"
+format_version: "3.5.0"
 name: mysql
 title: MySQL
-version: "1.28.1"
+version: "1.29.0"
 description: Collect logs and metrics from MySQL servers with Elastic Agent.
 type: integration
 categories: