Skip to content

[RnA] Restructures v1 alerting docs and adds v2 alerting docs#5460

Draft
nastasha-solomon wants to merge 3 commits intomainfrom
v2-alerting-docs
Draft

[RnA] Restructures v1 alerting docs and adds v2 alerting docs#5460
nastasha-solomon wants to merge 3 commits intomainfrom
v2-alerting-docs

Conversation

@nastasha-solomon
Copy link
Contributor

@nastasha-solomon nastasha-solomon commented Mar 12, 2026 •
edited
Loading

Summary

This PR fixes https://github.com/elastic/docs-content-internal/issues/869 by restructuring the Kibana alerting documentation to clearly separate v1 and v2 alerting, adds the full v2 alerting doc set, and creates a new entry point that helps readers choose the right alerting system. A detailed breakdown of what changed and why can be found here.

Previews

Technical review instructions

This PR adds the full Kibana alerting v2 documentation set and creates new entry-point pages for Elastic alerting. All content was written from internal architecture docs, offsite notes, and design specs — it needs technical review to confirm accuracy before publishing.

How to review

  • Focus on technical accuracy: Are the descriptions of behavior, field names, state transitions, pipeline steps, UI labels, and query patterns correct?
  • Flag anything that is wrong, misleading, outdated, or missing by leaving inline comments.
  • Don't worry about prose style, formatting, or link structure — those are handled separately.
  • If a page describes a feature or behavior that doesn't exist yet or has changed, call it out.

What to review

The pages are grouped below by topic area. You don't need to review every page — pick the areas you know best.

Entry points (3 pages)

These pages are the first thing readers see. Check that the system descriptions and comparisons are fair and accurate.

Page What to check
explore-analyze/alerting-overview.md Are the one-paragraph summaries of v1, v2, and Watcher accurate? Is the recommendation to prefer v1/v2 over Watcher appropriate?
explore-analyze/alerting/choose-an-alerting-system.md Is the "choose by use case" table steering readers to the right system? Is the comparison table accurate (especially availability, noise reduction, and alert data rows)?
explore-analyze/alerting/kibana-alerting-v2.md Are the core concept definitions correct (signals, alerts, episodes, series, notification policies, workflows)? Is the v1 vs v2 comparison table accurate? Is the architecture section (rule executor, director, dispatcher) correct?

Before you begin (3 pages)

Page What to check
kibana-alerting-v2/before-you-begin.md Are the prerequisites correct (9.4+, ES|QL knowledge, privileges)? Are the "key differences from v1" accurate? Is the coexistence description correct (separate tabs, separate indices, no auto-migration)?
kibana-alerting-v2/before-you-begin/set-up.md Are the setup steps and plugin dependencies accurate? Any missing configuration?
kibana-alerting-v2/before-you-begin/alerting-privileges.md Are the required Kibana privileges correct for rules, notification policies, and alert actions?

Author rules (10 pages)

Page What to check
kibana-alerting-v2/author-rules.md Is the detect vs. alert mode description accurate? Is the rule creation workflow correct?
author-rules/rule-types.md Are the ES|QL query patterns correct and functional? Do the example queries (threshold, change detection, ratio, no-data, percentile, SLO burn rate, etc.) produce the described results?
author-rules/rule-templates.md Are the described rule templates accurate? Do pre-built templates exist as described?
author-rules/create-rules-ui.md Does the UI rule creation flow match the current implementation (interactive mode, YAML mode, preview)?
author-rules/create-rules-discover.md Is the Discover-to-rule flow accurate?
author-rules/create-rules-yaml.md Is the YAML schema correct? Are all fields, types, and defaults accurate?
author-rules/set-rule-data-sources.md Are the data source configuration details correct (FROM commands, index patterns, cross-cluster search, alert indices)?
author-rules/rules-on-alerts.md Is the rules-on-alerts pattern correct? Can you actually query .alerts-events-* as a data source? Are the correlation and escalation examples valid?
author-rules/production-considerations.md Are the scheduling, query performance, dispatcher capacity, and data retention recommendations accurate?
author-rules/rule-settings.md Is the overview of all rule settings complete and accurate?

Rule settings (7 pages)

Page What to check
rule-settings/schedule-and-lookback.md Are the schedule interval and lookback window behaviors correct?
rule-settings/activation-and-recovery-thresholds.md Are the consecutive-breach and duration-based threshold behaviors correct? Are the state transition diagrams accurate?
rule-settings/no-data-handling.md Are the three no-data strategies (record no-data, carry forward, treat as recovery) correctly described?
rule-settings/grouping.md Is the grouping behavior correct (group_hash computation, per-group lifecycle)?
rule-settings/notification-policies.md Is the notification policy model correct (matching, grouping, throttling, routing)?
rule-settings/notification-policies/create-manage-notification-policies.md Are the create/configure/manage steps accurate? Are all policy fields correct?
rule-settings/notification-policies/how-notification-policies-are-evaluated.md Is the 10-step dispatcher pipeline accurate (fetch episodes, apply suppressions, evaluate matchers, build groups, apply throttling, dispatch, record outcomes)?
rule-settings/workflows.md Is the workflow model accurate? Are workflows correctly described as notification policy destinations?

Manage rules (3 pages)

Page What to check
kibana-alerting-v2/manage-rules.md Is the rules list description accurate (columns, filters, actions)? Is the v1/v2 tab layout correct?
manage-rules/view-manage-rules.md Are the rule detail page contents accurate (execution history, related rules, generated alerts)?
manage-rules/snooze-disable-rules.md Is the per-series snooze behavior correct? Is the difference between snooze and disable accurately described?

Manage alerts (5 pages)

Page What to check
kibana-alerting-v2/manage-alerts.md Is the alert inbox description accurate?
manage-alerts/view-alerts.md Are the alert inbox columns, filters, and quick-filter options correct?
manage-alerts/investigate-respond.md Is the alert flyout / detail page description correct? Are the metadata fields, timeline, and related-alerts views accurate?
manage-alerts/investigate-respond/alert-episode-details.md Are the episode lifecycle states and transitions correct? Is the episode identity (episode_id, group_hash) accurately described?
manage-alerts/investigate-respond/alert-actions.md Are all alert actions correct (acknowledge, snooze, deactivate, assign, tag, resolve, add to case)? Do they all exist?
manage-alerts/explore-alerts-discover.md Is the Discover integration accurate? Do the example ES|QL queries work against .alerts-events-*?

Reduce noise (11 pages)

Page What to check
kibana-alerting-v2/reduce-noise.md Is the overview of all noise reduction mechanisms complete?
reduce-noise/activation-thresholds.md Is the activation threshold behavior correct?
reduce-noise/recovery-thresholds.md Is the sustained-recovery requirement correct?
reduce-noise/no-data-handling.md Consistent with the rule-settings version of no-data handling?
reduce-noise/throttle.md Is the notification throttling behavior correct (minimum interval between notifications for the same group)?
reduce-noise/grouping.md Is the notification-policy grouping behavior correct?
reduce-noise/matcher.md Are KQL matchers on notification policies correctly described?
reduce-noise/snooze-or-silence.md Are snooze (per series), silence (attribute-based), and acknowledge (per episode) correctly distinguished?
reduce-noise/maintenance-windows.md Is the maintenance window behavior correct for v2?
reduce-noise/rules-on-alerts.md Consistent with the author-rules version?
reduce-noise/deactivate-alerts.md Is the deactivate behavior correct (stops lifecycle processing, rule continues)?

Reference (1 page)

Page What to check
kibana-alerting-v2/alert-event-field-reference.md Are the field names, types, and descriptions correct for .alerts-events-* documents? Is the index mapping accurate? Are common fields vs. alert-only fields correctly categorized?

Generative AI disclosure

  1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?
  • Yes
  • No

Cursor + Claude

@nastasha-solomon nastasha-solomon self-assigned this Mar 12, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Mar 12, 2026 •
edited
Loading

Vale Linting Results

Summary: 32 warnings, 77 suggestions found

⚠️ Warnings (32)
File Line Rule Message
explore-analyze/alerting-overview.md 12 Elastic.Spelling 'geofencing' is a possible misspelling.
explore-analyze/alerting/choose-an-alerting-system.md 34 Elastic.Spelling 'queryability' is a possible misspelling.
explore-analyze/alerting/choose-an-alerting-system.md 36 Elastic.BritishSpellings Use American English spelling 'acknowledgment' instead of British English 'acknowledgement'.
explore-analyze/alerting/kibana-alerting-v2/author-rules/create-rules-discover.md 50 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
explore-analyze/alerting/kibana-alerting-v2/author-rules/production-considerations.md 19 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
explore-analyze/alerting/kibana-alerting-v2/author-rules/production-considerations.md 38 Elastic.Spelling 'lookbacks' is a possible misspelling.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings.md 39 Elastic.EndPuntuaction Don't end headings with punctuation.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings.md 47 Elastic.EndPuntuaction Don't end headings with punctuation.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/notification-policies.md 27 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/notification-policies.md 36 Elastic.Spelling 'Reusability' is a possible misspelling.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/schedule-and-lookback.md 26 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
explore-analyze/alerting/kibana-alerting-v2/manage-alerts/explore-alerts-discover.md 93 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
explore-analyze/alerting/kibana-alerting-v2/manage-alerts/investigate-respond/alert-actions.md 13 Elastic.Spelling 'auditability' is a possible misspelling.
explore-analyze/alerting/kibana-alerting-v2/manage-alerts/investigate-respond/alert-actions.md 17 Elastic.Spelling 'unacknowledge' is a possible misspelling.
explore-analyze/alerting/kibana-alerting-v2/manage-alerts/investigate-respond/alert-actions.md 23 Elastic.Spelling 'Unacknowledge' is a possible misspelling.
explore-analyze/alerting/kibana-alerting-v2/manage-rules/snooze-disable-rules.md 62 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
explore-analyze/alerting/kibana-alerting-v2/reduce-noise/deactivate-alerts.md 30 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
explore-analyze/alerting/kibana-alerting-v2/reduce-noise/grouping.md 41 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'.
explore-analyze/alerting/kibana-alerting-v2/reduce-noise/maintenance-windows.md 22 Elastic.Spelling 'auditability' is a possible misspelling.
explore-analyze/alerting/kibana-alerting-v2/reduce-noise/matcher.md 36 Elastic.DontUse Don't use 'AND/OR'.
solutions/observability/incident-management/create-custom-threshold-rule.md 32 Elastic.Spelling 'geocoding' is a possible misspelling.
solutions/observability/incident-management/create-custom-threshold-rule.md 32 Elastic.Spelling 'geocoding' is a possible misspelling.
solutions/observability/incident-management/create-custom-threshold-rule.md 37 Elastic.QuotesPunctuation Place punctuation inside closing quotation marks.
solutions/observability/incident-management/create-custom-threshold-rule.md 53 Elastic.EndPuntuaction Don't end headings with punctuation.
solutions/observability/incident-management/create-custom-threshold-rule.md 80 Elastic.Spelling 'Cumbre' is a possible misspelling.
solutions/observability/incident-management/create-custom-threshold-rule.md 80 Elastic.Spelling 'Vieja' is a possible misspelling.
solutions/observability/incident-management/create-custom-threshold-rule.md 82 Elastic.Spelling 'Cumbre' is a possible misspelling.
solutions/observability/incident-management/create-custom-threshold-rule.md 82 Elastic.Spelling 'Vieja' is a possible misspelling.
solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md 246 Elastic.Spelling 'occured' is a possible misspelling.
solutions/observability/incident-management/create-log-threshold-rule.md 159 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
solutions/security/detect-and-alert.md 30 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
troubleshoot/elasticsearch/mapping-explosion.md 37 Elastic.Spelling 'Javascript' is a possible misspelling.
💡 Suggestions (77)
File Line Rule Message
deploy-manage/deploy/cloud-on-k8s/k8s-service-mesh-istio.md 15 Elastic.Versions Use 'or later' instead of 'or newer' when referring to versions.
deploy-manage/production-guidance/kibana-task-manager-scaling-considerations.md 15 Elastic.HeadingColons Capitalize ': p'.
deploy-manage/users-roles/cluster-or-deployment-auth/quickstart.md 25 Elastic.WordChoice Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.
explore-analyze/alerting-overview.md 17 Elastic.Wordiness Consider using 'act' instead of 'take action'.
explore-analyze/alerting/choose-an-alerting-system.md 17 Elastic.Ellipses In general, don't use an ellipsis.
explore-analyze/alerting/choose-an-alerting-system.md 21 Elastic.FirstPerson Use caution when using first-person pronouns such as 'my.'
explore-analyze/alerting/kibana-alerting-v1/alerting-common-issues-v1.md 85 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v1/alerting-getting-started-v1.md 27 Elastic.WordChoice Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v1/alerting-getting-started-v1.md 31 Elastic.Wordiness Consider using 'these' instead of 'all of these'.
explore-analyze/alerting/kibana-alerting-v1/alerting-troubleshooting-v1.md 36 Elastic.Wordiness Consider using 'also' instead of 'In addition'.
explore-analyze/alerting/kibana-alerting-v1/create-manage-rules-v1.md 10 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v1/create-manage-rules-v1.md 55 Elastic.Semicolons Use semicolons judiciously.
explore-analyze/alerting/kibana-alerting-v1/create-manage-rules-v1.md 127 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v1/create-manage-rules-v1.md 129 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v1/rule-types-v1.md 18 Elastic.WordChoice Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v1/view-alerts-v1.md 10 Elastic.WordChoice Consider using 'turn off, silence' instead of 'mute', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v1/view-alerts-v1.md 106 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/author-rules/production-considerations.md 19 Elastic.WordChoice Consider using 'run, start' instead of 'execute', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/no-data-handling.md 55 Elastic.HeadingColons Capitalize ': h'.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/no-data-handling.md 57 Elastic.WordChoice Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/no-data-handling.md 79 Elastic.HeadingColons Capitalize ': c'.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/notification-policies/create-manage-notification-policies.md 70 Elastic.WordChoice Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/notification-policies/create-manage-notification-policies.md 70 Elastic.WordChoice Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/notification-policies/create-manage-notification-policies.md 79 Elastic.WordChoice Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/notification-policies/create-manage-notification-policies.md 108 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/notification-policies/how-notification-policies-are-evaluated.md 21 Elastic.Wordiness Consider using 'because' instead of 'since'.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/schedule-and-lookback.md 52 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rule-settings/schedule-and-lookback.md 52 Elastic.WordChoice Consider using 'run, start' instead of 'execute', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rules-on-alerts.md 13 Elastic.Wordiness Consider using 'impossible' instead of 'not possible'.
explore-analyze/alerting/kibana-alerting-v2/author-rules/rules-on-alerts.md 55 Elastic.HeadingColons Capitalize ': m'.
explore-analyze/alerting/kibana-alerting-v2/author-rules/set-rule-data-sources.md 29 Elastic.FirstPerson Use caution when using first-person pronouns such as 'my.'
explore-analyze/alerting/kibana-alerting-v2/before-you-begin/set-up.md 44 Elastic.WordChoice Consider using 'efficient, basic' instead of 'simple', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/manage-alerts/investigate-respond.md 8 Elastic.Wordiness Consider using 'act' instead of 'take action'.
explore-analyze/alerting/kibana-alerting-v2/manage-alerts/investigate-respond.md 13 Elastic.Wordiness Consider using 'act' instead of 'take action'.
explore-analyze/alerting/kibana-alerting-v2/manage-alerts/investigate-respond.md 21 Elastic.Wordiness Consider using 'because' instead of 'since'.
explore-analyze/alerting/kibana-alerting-v2/manage-alerts/investigate-respond.md 42 Elastic.Wordiness Consider using 'because' instead of 'since'.
explore-analyze/alerting/kibana-alerting-v2/manage-rules.md 58 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/manage-rules/snooze-disable-rules.md 2 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/manage-rules/snooze-disable-rules.md 11 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/manage-rules/snooze-disable-rules.md 15 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/manage-rules/snooze-disable-rules.md 19 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/manage-rules/snooze-disable-rules.md 23 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/manage-rules/snooze-disable-rules.md 27 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/manage-rules/snooze-disable-rules.md 62 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/reduce-noise/maintenance-windows.md 19 Elastic.WordChoice Consider using 'run, start' instead of 'execute', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/reduce-noise/no-data-handling.md 13 Elastic.WordChoice Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
explore-analyze/alerting/kibana-alerting-v2/reduce-noise/throttle.md 19 Elastic.Wordiness Consider using 'because' instead of 'since'.
explore-analyze/machine-learning/anomaly-detection/ml-configuring-alerts.md 252 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
manage-data/data-store/data-streams/failure-store-recipes.md 310 Elastic.Wordiness Consider using 'because' instead of 'Since'.
manage-data/data-store/data-streams/failure-store-recipes.md 311 Elastic.WordChoice Consider using 'efficient, basic' instead of 'simple', unless the term is in the UI.
reference/fleet/monitor-elastic-agent.md 258 Elastic.WordChoice Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.
solutions/observability/incident-management/create-an-slo-burn-rate-rule.md 33 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/observability/incident-management/create-an-slo-burn-rate-rule.md 33 Elastic.Semicolons Use semicolons judiciously.
solutions/observability/incident-management/create-an-slo-burn-rate-rule.md 115 Elastic.Versions Use 'or earlier' instead of 'or lower' when referring to versions.
solutions/observability/incident-management/create-an-slo-burn-rate-rule.md 120 Elastic.WordChoice Consider using 'efficient, basic' instead of 'simple', unless the term is in the UI.
solutions/observability/incident-management/create-an-slo-burn-rate-rule.md 251 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/observability/incident-management/create-an-slo-burn-rate-rule.md 349 Elastic.Wordiness Consider using 'drag' instead of 'Drag and drop'.
solutions/observability/incident-management/create-an-slo-burn-rate-rule.md 358 Elastic.Wordiness Consider using 'all' instead of 'all of '.
solutions/observability/incident-management/create-custom-threshold-rule.md 37 Elastic.FirstPerson Use caution when using first-person pronouns such as 'me.'
solutions/observability/incident-management/create-custom-threshold-rule.md 42 Elastic.Wordiness Consider using 'also' instead of 'In addition'.
solutions/observability/incident-management/create-custom-threshold-rule.md 87 Elastic.WordChoice Consider using 'efficient' instead of 'easy', unless the term is in the UI.
solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md 29 Elastic.Semicolons Use semicolons judiciously.
solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md 53 Elastic.Versions Use 'or later' instead of 'or higher' when referring to versions.
solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md 115 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md 144 Elastic.Semicolons Use semicolons judiciously.
solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md 144 Elastic.Semicolons Use semicolons judiciously.
solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md 241 Elastic.Semicolons Use semicolons judiciously.
solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md 241 Elastic.WordChoice Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.
solutions/observability/incident-management/create-failed-transaction-rate-threshold-rule.md 252 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.
solutions/observability/incident-management/create-log-threshold-rule.md 159 Elastic.Wordiness Consider using 'because' instead of 'since'.
solutions/observability/incident-management/create-log-threshold-rule.md 272 Elastic.WordChoice Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.
solutions/observability/incident-management/create-log-threshold-rule.md 290 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
solutions/observability/incident-management/create-log-threshold-rule.md 291 Elastic.Wordiness Consider using 'because' instead of 'since'.
solutions/security/detect-and-alert/manage-detection-rules.md 103 Elastic.Semicolons Use semicolons judiciously.
solutions/security/detect-and-alert/using-logsdb-index-mode-with-elastic-security.md 65 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
troubleshoot/elasticsearch/mapping-explosion.md 35 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
troubleshoot/kibana/alerts.md 38 Elastic.Wordiness Consider using 'also' instead of 'In addition'.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

@github-actions
Copy link
Contributor

github-actions bot commented Mar 12, 2026

🔍 Preview links for changed docs

More links …

In total, 119 files changed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@nastasha-solomon nastasha-solomon

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nastasha-solomon