Alert id's are strings generated by alerting rules, and are typically specific to the rule, and often how the rule does grouping. For instance, some rules may provide a service/service name as the alert id.
It seems like in this case, * IS the alert id, given the document you provided. Did you generate the document from an index action attached to the alerting rule? Could you provide the body used for that action, I'm curious if something may have happened between the alert being generated and the document being written. If not generated from an index action, how did you get that data?