[8.10] [DOCS] Add information on KQL filtering in APM rules (#170257) (…

…#170425)

# Backport

This will backport the following commits from `main` to `8.10`:
- [[DOCS] Add information on KQL filtering in APM rules
(#170257)](#170257)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Colleen
McGinnis","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-11-02T14:29:54Z","message":"[DOCS]
Add information on KQL filtering in APM rules (#170257)\n\nCloses
https://github.com/elastic/observability-docs/issues/3160\r\n\r\n##
Summary\r\n\r\nAdds information on KQL filtering in APM
rules.\r\n\r\n### Checklist\r\n\r\n- [x] @colleenmcginnis initial
draft\r\n- [x] @benakansara review\r\n * In what version was this
initially added? 8.10.0?\r\n- [ ] @colleenmcginnis address feedback,
merge","sha":"e5bb85b4b3319f0c7d50276b48bf0759a60ca95c","branchLabelMapping":{"^v8.12.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","docs","v8.10.0","v8.11.0","v8.12.0"],"number":170257,"url":"https://github.com/elastic/kibana/pull/170257","mergeCommit":{"message":"[DOCS]
Add information on KQL filtering in APM rules (#170257)\n\nCloses
https://github.com/elastic/observability-docs/issues/3160\r\n\r\n##
Summary\r\n\r\nAdds information on KQL filtering in APM
rules.\r\n\r\n### Checklist\r\n\r\n- [x] @colleenmcginnis initial
draft\r\n- [x] @benakansara review\r\n * In what version was this
initially added? 8.10.0?\r\n- [ ] @colleenmcginnis address feedback,
merge","sha":"e5bb85b4b3319f0c7d50276b48bf0759a60ca95c"}},"sourceBranch":"main","suggestedTargetBranches":["8.10","8.11"],"targetPullRequestStates":[{"branch":"8.10","label":"v8.10.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.11","label":"v8.11.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.12.0","labelRegex":"^v8.12.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/170257","number":170257,"mergeCommit":{"message":"[DOCS]
Add information on KQL filtering in APM rules (#170257)\n\nCloses
https://github.com/elastic/observability-docs/issues/3160\r\n\r\n##
Summary\r\n\r\nAdds information on KQL filtering in APM
rules.\r\n\r\n### Checklist\r\n\r\n- [x] @colleenmcginnis initial
draft\r\n- [x] @benakansara review\r\n * In what version was this
initially added? 8.10.0?\r\n- [ ] @colleenmcginnis address feedback,
merge","sha":"e5bb85b4b3319f0c7d50276b48bf0759a60ca95c"}}]}] BACKPORT-->

Co-authored-by: Colleen McGinnis <[email protected]>

docs/apm/apm-alerts.asciidoc

@@ -103,6 +103,22 @@ Based on the criteria above, define the following rule details:
 * **Group alerts by** - `service.name` `service.environment`
 * **Check every** - `1 minute`
 
+[NOTE]
+====
+Alternatively, you can use a KQL filter to limit the scope of the alert:
+
+. Toggle on *Use KQL Filter*.
+. Add a filter, for example to achieve the same effect as the example above:
++
+[source,txt]
+------
+service.name:"{your_service.name}" and service.environment:"{your_service.environment}" and error.grouping_key:"{your_error.ID}"
+------
+
+Using a KQL Filter to limit the scope is available for _Latency threshold_, _Failed transaction rate threshold_, and
+_Error count threshold_ rules.
+====
+
 Select the **Email** connector and click **Create a connector**.
 Fill out the required details: sender, host, port, etc., and click **save**.