Note for mv_expand tiebreaker use

[hannahbrooks]

Summary

Requested upon discussion in issue #252936.

When mv_expand is used, all documents added to indices share the same _id and @timestamp. This leads to indeterministic ordering when ElasticSearch is pulling documents. There is no tiebreaker, so we get unpredictable results. Here we add a note to the docs to encourage users to add a tiebreaker and avoid this behaviour.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

Cursor with claude-open-4.6-high to refine and confirm what I had already written.

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/detect-and-alert/create-detection-rule.md

[nastasha-solomon]

Left a minor comment. Thanks again and congrats on your first docs contribution!