[9.0] [Custom threshold] Use createLazy instead of create when initializing searchSource (#213904) (#215211)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Custom threshold] Use createLazy instead of create when initializing
searchSource (#213904)](#213904)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Maryam
Saeidi","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-03-19T16:23:26Z","message":"[Custom
threshold] Use createLazy instead of create when initializing
searchSource (#213904)\n\n## Summary\n\nIn this PR, we use a similar
approach as was introduced in the ES Query\nrule in this
[PR](#183694) for the\ncustom
threshold rule to reduce the field_caps traffic using
createLazy.\n(Thanks @mikecote for pointing this
out!)\n\n||Screenshot|\n|---|---|\n|Create
(796\nms)|![image](https://github.com/user-attachments/assets/2df8f864-bbc5-44e4-af43-7ae70f5dd2c3)|\n|CreateLazy
(321\nms)|![image](https://github.com/user-attachments/assets/cd9a6e51-af7e-411a-ab2e-5d7a2efd3ce5)|\n\n###
🧪 How to test\n- Enable APM locally\n```\nelastic.apm.active:
true\nelastic.apm.transactionSampleRate: 1.0\nelastic.apm.environment:
username\n```\n- Create a custom threshold rule and check its execution
in\n[traces](https://kibana-cloud-apm.elastic.dev/app/apm/traces?rangeFrom=now-15m&rangeTo=now)\nfiltered
for your `username` as the environment. There should be one\nwith your
rule
name:\n<img\nsrc=\"https://github.com/user-attachments/assets/59274acc-3edf-4de7-8870-3b175af73523\"\nwidth=500
/>\n \nThe timing for `_field_caps` would be more if you replace
the\n`createLazy` with the `create`
function.","sha":"cc9494ccb057414d1eea9e27c51308854e521f05","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:obs-ux-management","backport:version","v9.1.0","v8.19.0","v8.18.1","v8.17.4"],"title":"[Custom
threshold] Use createLazy instead of create when initializing
searchSource","number":213904,"url":"https://github.com/elastic/kibana/pull/213904","mergeCommit":{"message":"[Custom
threshold] Use createLazy instead of create when initializing
searchSource (#213904)\n\n## Summary\n\nIn this PR, we use a similar
approach as was introduced in the ES Query\nrule in this
[PR](#183694) for the\ncustom
threshold rule to reduce the field_caps traffic using
createLazy.\n(Thanks @mikecote for pointing this
out!)\n\n||Screenshot|\n|---|---|\n|Create
(796\nms)|![image](https://github.com/user-attachments/assets/2df8f864-bbc5-44e4-af43-7ae70f5dd2c3)|\n|CreateLazy
(321\nms)|![image](https://github.com/user-attachments/assets/cd9a6e51-af7e-411a-ab2e-5d7a2efd3ce5)|\n\n###
🧪 How to test\n- Enable APM locally\n```\nelastic.apm.active:
true\nelastic.apm.transactionSampleRate: 1.0\nelastic.apm.environment:
username\n```\n- Create a custom threshold rule and check its execution
in\n[traces](https://kibana-cloud-apm.elastic.dev/app/apm/traces?rangeFrom=now-15m&rangeTo=now)\nfiltered
for your `username` as the environment. There should be one\nwith your
rule
name:\n<img\nsrc=\"https://github.com/user-attachments/assets/59274acc-3edf-4de7-8870-3b175af73523\"\nwidth=500
/>\n \nThe timing for `_field_caps` would be more if you replace
the\n`createLazy` with the `create`
function.","sha":"cc9494ccb057414d1eea9e27c51308854e521f05"}},"sourceBranch":"main","suggestedTargetBranches":["9.0","8.x","8.18","8.17"],"targetPullRequestStates":[{"branch":"9.0","label":"v9.0.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213904","number":213904,"mergeCommit":{"message":"[Custom
threshold] Use createLazy instead of create when initializing
searchSource (#213904)\n\n## Summary\n\nIn this PR, we use a similar
approach as was introduced in the ES Query\nrule in this
[PR](#183694) for the\ncustom
threshold rule to reduce the field_caps traffic using
createLazy.\n(Thanks @mikecote for pointing this
out!)\n\n||Screenshot|\n|---|---|\n|Create
(796\nms)|![image](https://github.com/user-attachments/assets/2df8f864-bbc5-44e4-af43-7ae70f5dd2c3)|\n|CreateLazy
(321\nms)|![image](https://github.com/user-attachments/assets/cd9a6e51-af7e-411a-ab2e-5d7a2efd3ce5)|\n\n###
🧪 How to test\n- Enable APM locally\n```\nelastic.apm.active:
true\nelastic.apm.transactionSampleRate: 1.0\nelastic.apm.environment:
username\n```\n- Create a custom threshold rule and check its execution
in\n[traces](https://kibana-cloud-apm.elastic.dev/app/apm/traces?rangeFrom=now-15m&rangeTo=now)\nfiltered
for your `username` as the environment. There should be one\nwith your
rule
name:\n<img\nsrc=\"https://github.com/user-attachments/assets/59274acc-3edf-4de7-8870-3b175af73523\"\nwidth=500
/>\n \nThe timing for `_field_caps` would be more if you replace
the\n`createLazy` with the `create`
function.","sha":"cc9494ccb057414d1eea9e27c51308854e521f05"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.17","label":"v8.17.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Maryam Saeidi <[email protected]>

Author: kibanamachine

x-pack/solutions/observability/plugins/observability/server/lib/rules/custom_threshold/custom_threshold_executor.test.ts

@@ -182,7 +182,7 @@ const setup = () => {
     ...alertsServices,
     getSearchSourceClient: jest.fn().mockResolvedValue({
       ...searchSourceCommonMock,
-      create: jest.fn(() => Promise.resolve(mockedSearchSource)),
+      createLazy: jest.fn(() => Promise.resolve(mockedSearchSource)),
     }),
   };
 

x-pack/solutions/observability/plugins/observability/server/lib/rules/custom_threshold/custom_threshold_executor.ts

@@ -123,7 +123,7 @@ export const createCustomThresholdExecutor = ({
           )
         : [];
 
-    const initialSearchSource = await searchSourceClient.create(params.searchConfiguration);
+    const initialSearchSource = await searchSourceClient.createLazy(params.searchConfiguration);
     const dataView = initialSearchSource.getField('index')!;
     const { id: dataViewId, timeFieldName } = dataView;
     const dataViewIndexPattern = dataView.getIndexPattern();