Docs fix — coherence: shard 1/1 — 3 findings

Generated by `gh-aw-docs-coherence-sweep` for `elastic/docs-content` on 2026-W25.

Shard 1/1 · 16 pages in slice · 0 recently-changed · 16 total in scope · corpus 16 pages.

## Findings (3)

```yaml
- file: explore-analyze/alerting/alerts/alerting-getting-started.md
line: 36
category: near-duplicate
severity: low
evidence: |
"A rule consists of three main parts: Conditions, Schedule, Actions" followed by
the identical server CPU example ("Check for average CPU usage > 0.9 on each
server..., Check every minute..., Send a warning email...via SMTP with subject
`CPU on {{server}} is high`"). The "Putting it all together" 4-point numbered
list (line 105) is reproduced nearly verbatim in both pages.
related_url: https://www.elastic.co/docs/explore-analyze/alerting/alerts
suggested_fix: |
The published overview at /docs/explore-analyze/alerting/alerts now covers the
same conceptual ground more concisely. Treat the overview page as the source of
truth for the rules/conditions/schedule/actions intro. Reduce alerting-getting-started.md
to content that the overview lacks (notably the Watcher comparison section) and
cross-link to the overview for the core concepts instead of repeating them.

- file: explore-analyze/alerting/alerts/rule-type-es-query.md
line: 225
category: near-duplicate
severity: low
evidence: |
The "Handling multiple matches of the same document" section (line 225) contains
an identical 4-row deduplication table (runs 0:00–0:03, match counts 113/127/159/190)
that also appears verbatim in the related published page. Beyond this section, the
"Define the conditions" steps, "Test your query" instructions, and "Add actions"
structure are substantially identical across both pages.
related_url: https://www.elastic.co/docs/solutions/observability/incident-management/create-an-elasticsearch-query-rule
suggested_fix: |
The in-scope Kibana page is the richer source of truth (it adds steps 7–8 for
consecutive runs and scope, and detailed action variables). Consolidate by keeping
the full rule definition in rule-type-es-query.md and having the Observability page
cross-link to it for shared sections (conditions, test query, handling duplicates),
retaining only Observability-specific navigation and role requirements locally.

- file: explore-analyze/alerting/alerts/view-alerts.md
line: 63
category: near-duplicate
severity: low
evidence: |
The "Alert statuses" (line 63), "Mute alerts" (line 82, including versioned
9.3+/9.0–9.2 applies-switch blocks), "Acknowledge alerts" (line 108), and
"Apply and filter alert tags" (line 125) sections are near-identical to the
corresponding sections in the Observability view-alerts page — including identical
field names (kibana.alert.workflow_status, kibana.alert.workflow_tags), same
flapping threshold example (6 changes in 10 runs), and same UI step sequences.
related_url: https://www.elastic.co/docs/solutions/observability/incident-management/view-alerts
suggested_fix: |
Extract the shared alert lifecycle content (statuses, mute, acknowledge, tags)
into a single canonical page (view-alerts.md is the natural home as the
Stack Management perspective). Replace the duplicated sections in the
Observability page with brief summaries and links to this page, retaining only
Observability-specific content (Related alerts tab, serverless role note,
Observability-specific navigation) in the Observability page.
```

## Done when
- Duplicate content is consolidated or replaced with a cross-link.
- Contradictions are reconciled, with one page as source of truth.
- A PR addressing this issue is merged.

## Notes
- No `contradictory-content` findings were identified in this shard; all three findings are `near-duplicate`.
- Pages with no non-self related results (maintenance-windows, notifications-domain-allowlist, geo-alerting, alerting-common-issues, event-log-index, rule-type-index-threshold, rule-types, testing-connectors) were reviewed and deemed coherent against their top related published docs.

> Generated by [Docs coherence sweep agent](https://github.com/elastic/docs-content/actions/runs/27794974420) · 415.7 AIC · ⌖ 13.1 AIC · ⊞ 26.4K · [◷](https://github.com/search?q=repo%3Aelastic%2Fdocs-content+is%3Aissue+%22gh-aw-workflow-call-id%3A+elastic%2Fdocs-content%2Fgh-aw-docs-coherence-sweep%22&type=issues)

Compare the named sections in explore-analyze/alerting/alerts/alerting-getting-started.md, rule-type-es-query.md, and view-alerts.md with their related published pages. Start by identifying which page should remain the source of truth for each duplicated section. Done means the repeated content is consolidated or cross-linked, contradictions are reconciled, and the three findings are addressed in a merged PR.

Written by the indexing model from the issue text.