Kibana alerting v2 schedule and lookback

The schedule and lookback settings control how often a rule runs and how far back it looks when evaluating data.

The execution interval (schedule.every) determines how frequently the rule evaluates.

The lookback window (schedule.lookback) determines the time range that the ES|QL query covers.

Choose a lookback window that is at least as long as the execution interval to avoid gaps in coverage.