elastic / elastic/docs-content
[ResponseOps][docs] ES Query rule type needs doc for alert id generated for grouped ES|QL results
- Dominant language
- No language data
- Stars
- 47
- Forks
- 261
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 116
Description
We need some doc [here](https://www.elastic.co/docs/explore-analyze/alerting/alerts/rule-type-es-query#:~:text=%40timestamp%20field.-,Alert%20group,-Select%20Create%20an). It currently says:
> Select Create an alert if matches are found to create a single alert for multiple events matching the ES|QL query. Select Create an alert for each row to create a separate alert for each event that matches the ES|QL query. Whenever possible, each alert is given a unique ID.
We should expand this to talk about how we create alert ids when "Create an alert for each row" is selected.
The general rules, which we'll have to make more precise are:
- if a STATS BY is used, we'll use the relevant grouping fields to generate the id
- if the query included the doc id metadata, and it exists in the returned columns, use that
- use column name + column value, for some number of the returned columns (up to 10?) to generate the ids
This is just doc, there is no intention of changing the way we calculated the alert id's, we just want to document it for the users. Specifically so they can craft their queries to return useful alert ids, which will end up showing up in their alerts.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.