I have used this solution for another visualization but here I can't.
In my example you can see more than one alert can have the same ALERT_ID (because the same "Rule" caused the errors).
If I use the ALERT_ID as ID in Elasticsearch, I'm not abel to see all alerts.
And in want to see all alerts, also the allready cleared in a visualization which showas how many alerts I had in the last few hours/days (Line chart).