elastic / elastic/docs-content

[ResponseOps][docs] ES Query rule type needs doc for alert id generated for grouped ES|QL results

Open
#6,510 6 comments 2 reactions 1 assignee Claimed by @nastasha-solomon View on GitHub
Planned-S25 Team:Experience
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 12h
Merged PRs (30d)
116

Description

We need some doc [here](https://www.elastic.co/docs/explore-analyze/alerting/alerts/rule-type-es-query#:~:text=%40timestamp%20field.-,Alert%20group,-Select%20Create%20an). It currently says:

> Select Create an alert if matches are found to create a single alert for multiple events matching the ES|QL query. Select Create an alert for each row to create a separate alert for each event that matches the ES|QL query. Whenever possible, each alert is given a unique ID.

We should expand this to talk about how we create alert ids when "Create an alert for each row" is selected.

The general rules, which we'll have to make more precise are:

- if a STATS BY is used, we'll use the relevant grouping fields to generate the id
- if the query included the doc id metadata, and it exists in the returned columns, use that
- use column name + column value, for some number of the returned columns (up to 10?) to generate the ids

This is just doc, there is no intention of changing the way we calculated the alert id's, we just want to document it for the users. Specifically so they can craft their queries to return useful alert ids, which will end up showing up in their alerts.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.