[Alerting V2][Serverless & 9.5][M2] Dispatcher changes from May 2026

[nastasha-solomon]

Summary

Updates the action policy docs for the experimental alerting features with content from eight doc issues. Following the tech preview principle of accuracy over comprehensiveness, changes focus on stable concepts and system behavior rather than UI details that are subject to change.

Per-rule action policies (#6613)

The most significant conceptual change in this batch. The previous docs described all action policies as global within a space. PR #268006 introduced a global / single_rule type discriminator, making the existing description factually incorrect.

notifications.md — Updated "What is an action policy" to define both policy types, their scoping rules, and when to use each. Updated "How policies apply to rules" to distinguish global and per-rule scoping. Updated "Why policies are separate from rules" to reflect that per-rule policies exist for rule-specific routing.

create-configure-action-policy.md — Added a Policy type field section explaining the global/per-rule distinction, the immutability constraint, and when to choose each type. Updated the opening paragraph and the match conditions scope description to reflect both types.

Policy tags (#6616)

PR #261008 added a tags field to notification policies across the full stack.

create-configure-action-policy.md — Added a Tags field section explaining that policy tags are organizational labels distinct from rule tags and do not affect routing behavior.

Quick filter KQL fields (#6608)

PR #261601 added Rule, Status, and Tags quick filter pickers to the match conditions form. The pickers generate rule.id, episode_status, and rule.tags KQL respectively.

action-policy-reference.md — Added rule.tags to the match conditions field reference table. This field was missing but is now surfaced by the quick filters and used in examples across the docs.

create-configure-action-policy.md — Updated the match conditions example from data.severity to rule.tags: "payment-service" to reflect the fields that quick filters generate.

Maintenance window suppression (#6416)

PR #267771 added backend suppression logic for maintenance windows in the dispatcher.

action-policy-reference.md and notifications.md — Updated the suppressed dispatch outcome description to include maintenance windows as a cause alongside acknowledge, snooze, and deactivate.

View policy details (#6419)

PR #264497 added a details flyout to the Action policies list page.

manage-action-policies.md — Added a "View policy details" section describing that a policy's full configuration and all per-policy actions are accessible from the list page. UI mechanics (flyout vs. dedicated page) are omitted as the IA is not yet stable.

Policy execution history (#6501)

PR #266775 added a Policy Execution History UI and API.

manage-action-policies.md — Added an "Execution history" section describing how to query dispatch outcomes per policy using the .alert-actions data stream. The section points to the existing dispatch outcomes reference rather than documenting the UI, which is subject to change.

Out of scope for this PR

• #6498 (optional matcher query parameter on the data fields suggestions endpoint): API reference detail with no conceptual home yet.
• #6617 (grouping modes and frequency strategies redesign): The existing reference and create-configure pages already cover this content accurately. No new stable concepts to add at the tech preview stage.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes - Cursor + Claude
• No

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.