Skip to content

Commit 68a179f

Browse files
Apply suggestions from code review
Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>
1 parent 89389ea commit 68a179f

3 files changed

Lines changed: 7 additions & 3 deletions

File tree

explore-analyze/alerting/kibana-alerting-experimental/alerts.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,10 @@ A rule in Detect mode only writes signals. It never opens episodes, so action po
131131

132132
Alert events are stored in `.rule-events`. Triage actions (acknowledge, snooze, resolve) are stored in `.alert-actions`. Both are queryable in Discover.
133133

134-
Every time you take an action on an episode — acknowledging it, snoozing it, resolving it, editing its tags — {{kib}} writes a new document to `.alert-actions`. These documents are append-only and can be queried in Discover for auditing and metrics such as mean time to acknowledge (MTTA). For field definitions, refer to [Alert states and fields reference](alerts/alert-states-and-fields-reference.md#alert-states-reference).
134+
Every time you take an action on an episode (for example, acknowledging it, snoozing it, resolving it, editing its tags) {{kib}} writes a new document to `.alert-actions`. These documents are append-only and can be queried in Discover for auditing and metrics such as mean time to acknowledge (MTTA). For field definitions, refer to Alert states and fields reference.
135+
136+
<!-- TODO: Re-add ref to the "Alert states and fields reference" page
137+
-->
135138

136139
<!--[CONTENT NEEDED for M2: UI. "V2 Alerting Preview" is a development-phase navigation label. Once the navigation and page name have been confirmed, add instructions for opening the Alerts page.]
137140
-->
@@ -140,7 +143,10 @@ Every time you take an action on an episode — acknowledging it, snoozing it, r
140143

141144
Both `.rule-events` and `.alert-actions` are data streams, append-only, time-series stores optimized for writes. On every rule evaluation, {{kib}} writes a **new document** to `.rule-events` rather than updating the previous one. Each document is a point-in-time snapshot. The `episode.status` field records the lifecycle state the episode was in at that exact evaluation. Nothing is overwritten.
142145

146+
<!-- TODO: Uncomment this after fix link issue.
147+
143148
Because every evaluation produces its own document, you can reconstruct the full history of an episode by querying all documents that share the same `episode.id`. Refer to [Query alerts and signals in Discover](alerts/query-alerts-and-signals-in-discover.md#explore-alerts-discover) for example queries.
149+
-->
144150

145151
Retention is managed automatically through ILM. Older backing indices move through storage tiers and are deleted when the retention window expires. You do not need to manually remove documents. {{kib}} manages versioning, retention, and lifecycle for both streams. Do not change their mappings or index settings.
146152

explore-analyze/alerting/kibana-alerting-experimental/alerts/query-alerts-and-signals-in-discover.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ To use this page, open Discover, select {{esql}}, paste a query from the example
2222
<!--[CONTENT NEEDED for M2: Review and expand the query examples below once M2 field renames (`group_hash` → `series.key`, new `series.tracked_by`, `episode.severity`, `episode.severity_max`) are finalized. Add examples that take advantage of the new first-class severity and series fields.]
2323
-->
2424

25-
For field names, types, and episode fields, refer to [Alert states and fields reference](alert-states-and-fields-reference.md#alert-states-reference). For triage in the product UI, refer to [View, manage, and reference alerts](view-and-manage-alerts.md).
2625
<!-- TODO: Uncomment when PR #6523 (rules) is merged and restore full sentence:
2726
For field names, types, and episode fields, refer to [Alert states and fields reference](alert-states-and-fields-reference.md#alert-states-reference) and [Rule event and field reference](../rules/rule-event-field-reference.md#rule-reference). For triage in the product UI, refer to [View, manage, and reference alerts](view-and-manage-alerts.md).
2827
-->

explore-analyze/alerting/kibana-alerting-experimental/alerts/view-and-manage-alerts.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,6 @@ Some actions apply only to the specific episode you acted on. Others apply to ev
128128
| Edit tags | Episode |
129129
| Assign | Episode |
130130

131-
For field definitions and state descriptions, refer to [Alert states and fields reference](alert-states-and-fields-reference.md#alert-states-reference).
132131
<!-- TODO: Uncomment when PR #6525 (workflows/notifications) is merged and restore full sentence:
133132
For field definitions and state descriptions, refer to [Alert states and fields reference](alert-states-and-fields-reference.md#alert-states-reference). For how {{kib}} records actions in `.alert-actions` and how notification gating works, refer to [Notification gating](../notifications/notification-gating.md#notification-gating).
134133
-->

0 commit comments

Comments
 (0)