[Alerting V2][Serverless & 9.5][M2] Rule feature changes from May 2026

[nastasha-solomon]

Summary

Updates the rules docs for the experimental alerting features with content from fifteen doc issues. Following the tech preview principle of accuracy over comprehensiveness, changes focus on stable concepts — what the system does, when to use each feature, how creation paths work — rather than UI-level procedures that are subject to change before GA.

Naming guidelines compliance (all files)

Systematic corrections across all nine rules pages to bring H1 titles and anchor sentences into line with the naming guidelines for the experimental alerting features.

All rules files — Removed "the" from H1 titles where {{alerting-v2}} appears (title convention: no article). Updated four anchor sentences that used gerund subjects (Authoring rules is part of..., Configuring rules is part of..., Viewing and managing rules is part of..., Creating rules from Discover is part of...) to concrete noun subjects (Rule authoring is part of..., Rule configuration is part of..., Rule management is part of...). Added the system name to H1 titles on three pages that were missing it (create-rule-from-discover.md, create-rule-from-rule-builder.md, create-rule-with-yaml.md). Updated yaml-rule-schema-reference.md to YAML rule schema reference for {{alerting-v2}}.

Flyout-only rule authoring and creation paths (#6612, #6500, #6607)

PR #269629 removed standalone full-page rule form routes. All rule creation and editing now happens through a flyout. PR #267779 introduced the three-path onboarding panel, and PR #269156 wired the Create ES|QL rule card to open the flyout inline rather than navigate to a page.

rules.md — Added a Create a rule section establishing that all rules are created through a flyout (never a full-page form) and describing the three starting points at a conceptual level: from scratch, from Discover, and with the AI agent. Added a third Next Steps link pointing to configure-a-rule.md.

create-rule-from-rule-builder.md — Added a Creation paths section documenting the three options on the rule creation panel (from scratch, from recommended rules, with AI agent), with guidance on when to choose each. Added a note that the AI agent path is also accessible from the split button on the rules list once rules exist.

Form/YAML toggle in the rule authoring flyout (#6606, #6418)

PR #269150 added a YAML editing mode to the Compose Discover flyout, and PR #265929 added the toggle to the Discover-based flyout. Both share the same sync behavior.

create-rule-from-rule-builder.md — Added a Form and YAML editing section explaining that the rule creation flyout supports both a step-by-step form and a YAML editing mode, that edits in either mode are preserved when switching views, and that Cancel YAML discards edits and restores prior form state.

create-rule-from-discover.md — Added a matching Form and YAML editing section with the same behavioral description, plus a note that the YAML editor includes ES|QL autocomplete in the query field.

Create rules from Discover (#6614, #6499)

PR #260844 added the Create ES|QL rule entry point to the Discover Alerts menu, and PR #268774 introduced the Compose Discover stepped flyout from the rules list.

create-rule-from-discover.md — Added an Entry points section documenting both paths into Discover-based rule creation: the Alerts menu in Discover (available only in ES|QL mode) and the rules list. Removed a stale cross-reference implying the rule builder holds the YAML toggle that is now also present in the Discover flyout.

Separate alert and recovery conditions (#6605)

PR #269023 introduced query splitting for the Compose Discover flow, separating the base data pipeline from the alert condition and adding an explicit Recovery Condition step with three recovery types.

author-rules.md — Added a Recovery condition subsection under the ES|QL query structure section, documenting Default (auto-recover when alert condition clears), Custom (separate ES|QL expression), and No recovery (coming soon). Includes guidance on when to choose a custom recovery condition over the default.

AI agent entry points for rule creation (#6604)

PR #269588 added Create with agent entry points to both the rules list split button and the rule creation options panel.

create-rule-from-rule-builder.md — Covered as part of the Creation paths section above: the AI agent option is available in both the empty-state onboarding panel and via the split button on the rules list once rules exist.

Rule search behavior (#6420, #6615)

PR #265303 rewrote the rules list search to use the Saved Objects client's simple_query_string, fixing special-character failures. PR #261154 expanded search to match metadata.description in addition to metadata.name.

view-manage-rules.md — Updated the Find and filter rules section to document that search matches rule name and description only using prefix matching (terms AND'd), that tags and grouping fields are displayed in results but not full-text searched, and that special characters including consecutive hyphens are handled correctly.

Quick-edit a rule (#6417)

PR #268164 added the Quick Edit flyout, accessible from the pencil icon in a rule row or from the rule summary flyout header.

view-manage-rules.md — Added a Quick-edit a rule section documenting which fields are editable in this view (name, description, tags, grouping key, time field, interval, lookback, alert delay, recovery type, recovery delay) and which are read-only (ES|QL query, alert tracking behavior). UI entry-point mechanics are omitted as the IA is not yet stable.

Group fields align with STATS...BY (#6415)

PR #268522 added auto-population of the Group Fields combobox from the STATS ... BY clause as the user types.

configure-a-rule.md — Added a note under Rule grouping explaining that the group fields in the rule form reflect the columns produced by STATS ... BY, and that writing the query first avoids mismatches between query output and grouping configuration.

Out of scope for this PR

• #6012 (no-data handling UI control, serverless only, June 2 release): The configure-a-rule.md already documents the three no_data.behavior values accurately. No new stable concepts to add; UI control details deferred.
• #6018 (query preview/test in Discover): Covered by the existing query preview section in create-rule-from-discover.md. UI procedure deferred until IA is stable.
• #6603 (action policy support in Agent Builder): Belongs in the action policy docs, not the rules pages.
• #6611 (step indicator in the rule flyout): Minor UI chrome with no stable conceptual content to add at the tech preview stage.
• #6015: Closed as not planned.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes - Cursor + Claude sonnet
• No

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.