Update docs on filtering alerts by string params (#92239) (#92390)

Co-authored-by: Mike Côté <mikecote@users.noreply.github.com>

docs/api/alerts/find.asciidoc

@@ -6,6 +6,9 @@
 
 Retrieve a paginated set of alerts based on condition.
 
+NOTE: As alerts change in {kib}, the results on each page of the response also
+change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.
+
 [[alerts-api-find-request]]
 ==== Request
 
@@ -14,6 +17,8 @@ Retrieve a paginated set of alerts based on condition.
 [[alerts-api-find-query-params]]
 ==== Query Parameters
 
+NOTE: Alert `params` are stored as a {ref}/flattened.html[flattened field type] and analyzed as keywords.
+
 `per_page`::
   (Optional, number) The number of alerts to return per page.
 
@@ -46,11 +51,6 @@ Retrieve a paginated set of alerts based on condition.
   It should look like savedObjectType.attributes.title: "myTitle". However, If you used a direct attribute of a saved object, such as `updatedAt`,
   you will have to define your filter, for example, savedObjectType.updatedAt > 2018-12-22.
 
-NOTE: As alerts change in {kib}, the results on each page of the response also
-change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.
-
-NOTE: Alert `params` are stored as {ref}/flattened.html[flattened] and analyzed as `keyword`.
-
 [[alerts-api-find-request-codes]]
 ==== Response code