[Transform] Associate legacy audit index (elastic#136508) (elastic#136622)

If a user manually creates the legacy audit index,
TransformClusterStateListener will automatically add the non-legacy
alias to forward messages to it. If the transform feature had never been
accessed before (for example after the feature is reset), then the next
time the auditor is called, it will associate with the existing legacy
index rather than the notifications index.

We cannot cleanly block users from manually creating system or hidden
indices (yet), but we can associate the legacy index with the transform
feature so that a feature reset will delete the legacy index (like it
does with the notifications index). The next time the transform feature
is used, it will automatically create the notifications index rather
than reusing the legacy index.

Resolve elastic#121241

Author: prwhelan

docs/changelog/136508.yaml

@@ -0,0 +1,6 @@
+pr: 136508
+summary: Associate legacy audit index
+area: Transform
+type: bug
+issues:
+ - 121241

muted-tests.yml

@@ -540,6 +540,3 @@ tests:
 - class: org.elasticsearch.packaging.test.DockerTests
   method: test010Install
   issue: https://github.com/elastic/elasticsearch/issues/131376
-- class: org.elasticsearch.xpack.transform.integration.TransformAuditorIT
-  method: testAuditorWritesAudits
-  issue: https://github.com/elastic/elasticsearch/issues/121241

x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/Transform.java

@@ -128,6 +128,7 @@
 import static org.elasticsearch.xpack.core.ClientHelper.TRANSFORM_ORIGIN;
 import static org.elasticsearch.xpack.core.transform.TransformMessages.FAILED_TO_UNSET_RESET_MODE;
 import static org.elasticsearch.xpack.core.transform.transforms.persistence.TransformInternalIndexConstants.AUDIT_INDEX_PATTERN;
+import static org.elasticsearch.xpack.core.transform.transforms.persistence.TransformInternalIndexConstants.AUDIT_INDEX_PATTERN_DEPRECATED;
 import static org.elasticsearch.xpack.core.transform.transforms.persistence.TransformInternalIndexConstants.TRANSFORM_PREFIX;
 import static org.elasticsearch.xpack.core.transform.transforms.persistence.TransformInternalIndexConstants.TRANSFORM_PREFIX_DEPRECATED;
 
@@ -436,7 +437,10 @@ public Collection<SystemIndexDescriptor> getSystemIndexDescriptors(Settings sett
 
     @Override
     public Collection<AssociatedIndexDescriptor> getAssociatedIndexDescriptors() {
-        return List.of(new AssociatedIndexDescriptor(AUDIT_INDEX_PATTERN, "Audit index"));
+        return List.of(
+            new AssociatedIndexDescriptor(AUDIT_INDEX_PATTERN, "Audit index"),
+            new AssociatedIndexDescriptor(AUDIT_INDEX_PATTERN_DEPRECATED, "Legacy audit index")
+        );
     }
 
     @Override