There is value for an alert to be purely working with ES DSL query and alerts on data returned.

Things to investigate:

• Look at current query based alerting as implemented by Watcher. Many questions have been raised by users who wish to achieve the same in Alerting as they currently do in Watcher. We don't have to have feature parity, but knowing where the differences are is valuable.
• What constitutes an Alert Instance? Is it (most of these can be roadmap items but we can start with one):
  • per document
  • per count
  • above/below count
  • can we base instances off of an aggregation result somehow?
• Painless support - are there limitations on what we can support? (Can we support this for example)
• UI experience (none at the beginning, JSON editor or expression style field selector "x is y")
• Using the --examples flag or POC to integrate with console app
• Using the --examples flag or POC to integrate with discover app (see Proof of concept integrating "search alert" with discover #61314)