[DOCS] Update transform health rule details (elastic#105719)

docs/reference/transform/transform-alerts.asciidoc

@@ -1,23 +1,18 @@
-[role="xpack"]
 [[transform-alerts]]
 = Generating alerts for {transforms}
-
-beta::[]
-
-{kib} {alert-features} include support for {transform} rules, which check the 
-health of {ctransforms} with certain conditions. If the conditions of the rule 
-are met, an alert is created and the associated action is triggered. For 
+:frontmatter-description: Create {transform} health rules.
+:frontmatter-tags-products: [alerting]
+:frontmatter-tags-content-type: [how-to]
+:frontmatter-tags-user-goals: [configure]
+
+{kib} {alert-features} include support for {transform} health rules, which 
+check the health of {ctransforms} with certain conditions. If the conditions of
+the rule are met, an alert is created and the associated actions run. For 
 example, you can create a rule to check if a {ctransform} is started and to 
 notify you in an email if it is not. To learn more about {kib} {alert-features}, 
 refer to 
 {kibana-ref}/alerting-getting-started.html#alerting-getting-started[Alerting].
 
-The following {transform} rules are available:
-
-{transform-cap} health:: 
-  Monitors {transforms} health and alerts if an operational issue occurred.
-
-
 [[creating-transform-rules]]
 == Creating a rule
 
@@ -30,14 +25,11 @@ tags. Select the {transform} health rule type:
 image::images/transform-rule.png["Creating a transform health rule",500]
 // NOTE: This is screenshot is automatically generated. Do not edit it directly.
 
-[[creating-transform-health-rules]]
-=== {transform-cap} health
-
 Select the {transform} or {transforms} to include. You can also use a special 
 character (`*`) to apply the rule to all your {transforms}. {transforms-cap} 
 created after the rule are automatically included.
 
-The following health check is available and enabled by default:
+The following health checks are available and enabled by default:
 
 _{transform-cap} is not started_:: 
   Notifies if the corresponding {transforms} is not started or it does not index 
@@ -53,35 +45,50 @@ image::images/transform-check-config.png["Selecting health check",500]
 
 As the last step in the rule creation process, define its actions.
 
-
 [[defining-actions]]
 == Defining actions
 
 You can add one or more actions to your rule to generate notifications when its
-conditions are met and when they are no longer met.
+conditions are met and when they are no longer met. In particular, this rule
+type supports:
 
-Each action uses a connector, which stores connection information for a {kib}
-service or supported third-party integration, depending on where you want to
-send the notifications. For example, you can use a Slack connector to send a
-message to a channel. Or you can use an index connector that writes an JSON
-object to a specific index. For details about creating connectors, refer to
+* alert summaries
+* actions that run when an issue is detected
+* recovery actions that run when the rule conditions are no longer met
+
+For each action, you must choose a connector, which provides connection
+information for a {kib} service or third party integration. For more information
+about all the supported connectors, go to
 {kibana-ref}/action-types.html[Connectors].
 
-You must set the action frequency, which involves choosing how often to run
-the action (for example, at each check interval, only when the alert status
-changes, or at a custom action interval). Each rule type also has a list of
-valid action groups and you must choose one of these groups (for example, the
-action runs when the issue is detected or when it is recovered).
+After you select a connector, you must set the action frequency. You can choose
+to create a summary of alerts on each check interval or on a custom interval.
+For example, send notifications that summarize the new, ongoing, and recovered
+alerts:
+
+[role="screenshot"]
+image::images/transform-alert-summary-actions.png["Setting action frequency to summary of alerts",500]
+// NOTE: This is screenshot is automatically generated. Do not edit it directly.
 
 TIP: If you choose a custom action interval, it cannot be shorter than the
 rule's check interval.
 
-It's also possible to customize the notification messages for each action. A
-list of variables is available to include in the message, like {transform} ID,
-description, {transform} state, and so on.
+Alternatively, you can set the action frequency such that actions run for each
+alert. Choose how often the action runs (at each check interval, only when the
+alert status changes, or at a custom action interval). You must also choose an
+action group, which indicates whether the action runs when the issue is detected
+or when it is recovered.
+
+You can further refine the conditions under which actions run by specifying that
+actions only run when they match a KQL query or when an alert occurs within a
+specific time frame.
+
+There is a set of variables that you can use to customize the notification
+messages for each action. Click the icon above the message text box to get the
+list of variables or refer to <<transform-action-variables>>.
 
 [role="screenshot"]
-image::images/transform-alert-actions.png["Selecting connector type",500]
+image::images/transform-alert-actions.png["Selecting action variables",500]
 // NOTE: This is screenshot is automatically generated. Do not edit it directly.
 
 After you save the configurations, the rule appears in the *{rules-ui}* list 
@@ -92,3 +99,44 @@ The name of an alert is always the same as the {transform} ID of the associated
 {transform} that triggered it. You can mute the notifications for a particular 
 {transform} on the page of the rule that lists the individual alerts. You can 
 open it via *{rules-ui}* by selecting the rule name.
+
+[[transform-action-variables]]
+== Action variables
+
+The following variables are specific to the {transform} health rule type.
+You can also specify {kibana-ref}/rule-action-variables.html[variables common to all rules].
+
+`context.message`::
+A preconstructed message for the rule. For example: `Transform test-1 is not started.`
+
+`context.results`::
+The most recent results, which you can iterate over by using the 
+https://mustache.github.io/[Mustache] template array syntax. For example, the
+message in an email connector action might contain:
++
+--
+[source,sh]
+--------------------------------------------------
+[{{rule.name}}] Transform health check result:
+{{context.message}}
+{{#context.results}}
+  Transform ID: {{transform_id}}
+  {{#description}}Transform description: {{description}}
+  {{/description}}{{#transform_state}}Transform state: {{transform_state}}
+  {{/transform_state}}{{#health_status}}Transform health status: {{health_status}}
+  {{/health_status}}{{#issues}}Issue: {{issue}}
+  Issue count: {{count}}
+  {{#details}}Issue details: {{details}}
+  {{/details}}{{#first_occurrence}}First occurrence: {{first_occurrence}}
+  {{/first_occurrence}}
+  {{/issues}}{{#failure_reason}}Failure reason: {{failure_reason}}
+  {{/failure_reason}}{{#notification_message}}Notification message: {{notification_message}}
+  {{/notification_message}}{{#node_name}}Node name: {{node_name}}
+  {{/node_name}}{{#timestamp}}Timestamp: {{timestamp}}
+  {{/timestamp}}
+{{/context.results}}
+--------------------------------------------------
+--
+
+For more examples, refer to
+{kibana-ref}/rule-action-variables.html[Rule action variables].