[Alerting V2][Serverless & 9.5][M2] Alerting feature changes from May 2026

[nastasha-solomon]

Summary

Updates alert episode docs for the experimental alerting features with content from two doc issues and naming compliance fixes across all four files in the section. Following the tech preview principle of accuracy over comprehensiveness, content additions focus on confirmed stable behavior rather than UI details subject to change.

Open in Discover: confirmed ±15-minute time window (#6609, #6168)

Issues #6168 and #6609 tracked the same feature across two milestones. The original M2 content-needed comment flagged uncertainty about whether the Discover link would surface the base query, the alert condition query, or both. M2 shipped with the base query only, with the time range set to ±15 minutes around the episode timestamp.

view-and-manage-alerts.md — Updated the Open in Discover section with the confirmed time window. Removed an orphan snooze paragraph that had been pasted into the middle of the section. Added a requirements note (ES|QL enabled, Discover access). Removed the stale M2 content-needed comment.

Grouping field values in the episodes table (#6610)

The previous Grouping bullet described the feature as detail-page-only. PR #267672 surfaces grouping field values throughout the alerting experience, including the episodes table and the related episodes subsection on the detail page.

view-and-manage-alerts.md — Updated the Grouping bullet in the episode detail page section to reflect that grouping values appear in both the episodes table and the detail page. Explains what each value shows (host.name: web-01) and why it helps. UI specifics (badge presentation, popover interaction) are omitted per tech preview doc principles.

Naming compliance across all four files

A pass against the naming guidelines found violations in all four files in the section.

alerts.md — H1 used the banned {{alerting-v2-cap}} variable, which the guidelines explicitly prohibit ("Do not create a separate capitalized variant"). Replaced with # Alerts in {{alerting-v2}} using the feature-first pattern. Added the required anchor sentence, which was missing entirely.

view-and-manage-alerts.md — H1 omitted the system name. Updated to # View and manage alerts in {{alerting-v2}}. Added the required anchor sentence (Alert triage is part of the {{alerting-v2}} in Kibana.).

query-alerts-and-signals-in-discover.md — H1 omitted the system name. Updated to # Query alerts and signals in Discover in {{alerting-v2}}. Anchor sentence used a gerund subject (Querying alerts and signals in Discover is part of...), which the guidelines flag as an anti-pattern. Changed to a concrete noun subject: Alert and signal queries in Discover are part of...

alert-states-and-fields-reference.md — H1 omitted the system name. Updated to # Alert states and fields reference in {{alerting-v2}}. Existing anchor sentence was already correct.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes - Cursor + Claude sonnet
• No

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.