Currently, the lifecycle rule type appends alert events only. To confirm to the proposed indexing strategy , alert documents should be written (and updated) to alerts-observability-*.alerts, and metric documents should be written to alerts-observability-*.events. We should consider the following questions:

• Do we always update the alert document, or only when it activates/recovers? The former will have a bigger performance impact than the latter, but will allow us to record severity/duration etc on the alert document.
• Do we use index with a predetermined id to update documents, or do we fetch the alert document first when we want to update it? The former would be better for performance, but we have to fetch the alert document anyway when it recovers.

cc @tsg @jasonrhodes @spong @smith