[Alerting V2][Serverless & 9.5][M2] Fix forced-recovery step in tutorial

[nastasha-solomon]

Summary

In a Slack convo with @jasonrhodes, I learned that deleting the degraded documents entirely (_delete_by_query) doesn't reliably move the episode to inactive. With no documents left for checkout, the ES|QL query returns zero rows, which the system treats as "no data" rather than a confirmed non-breaching evaluation (which is a distinct state from genuine recovery). This meant the tutorial's forced-recovery step didn't actually produce the recovery behavior it was meant to demonstrate.

To fix this, I replaced the _delete_by_query call with an _update_by_query call that rewrites the degraded documents' latency_ms values to a healthy level (300ms). This keeps a row for checkout in the query results, just under the threshold, so the rule evaluates a genuine recovery condition.

I also made some minor improvements to the tutorial overall:

• The "Key concepts" section was reframed to convey learning outcomes ("By completing this tutorial, you learned...") instead of recapping tutorial actions.
• The rule lookback window was shortened from 2 hours to 45 minutes so users don't need to wait as long to witness the automatic recovery behavior.

NOTE: kibana#277561 prevents the alert episode from switching to inactive at the end of the tutorial. That PR was recently merged, so the final lifecycle change should happen as the tutorial describes once the fix is available in serverless.

Preview

Create a rule and observe the alert lifecycle

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes - Cursor + Claude
• No

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• explore-analyze/alerting/experimental-alerting-system/get-started/create-your-first-rule.md

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.