update bro alerts to account for default ES search size
merge upstream doc changes