Updates alert specification documnetation to include the JSON message posted to alert handlers

docs/AlertsSpecification.md

@@ -362,3 +362,53 @@ For example:
     * even if you put something else for field value, it will be ignored - only the **measurement** name is used
     * **aggregation_method** is not required in this event type, any values provided will be ignored
     * **comparison operator** is not required in this event type, any values provided will be ignored
+
+
+##### Alert messages
+
+Every alert handler registered in a trigger *action --> implementation* section receives an alert message when the trigger
+event condition is true. This alert message is sent using an *HTTP POST* request to the URL of the alert handler. The alert
+message is generated by Kapacitor and, currently, clmc-service has limited control over it. An alert message follows this format:
+
+```json
+{
+    "message": "TRUE",
+    "id": "<trigger_id>",
+    "level": "CRITICAL",
+    "duration": "<integer for the duration of alert - nanoseconds>",
+    "previousLevel": "<the previous level of the alert>",
+    "details": "<a context string with info on what triggered the alert>",
+    "time": "<timestamp of the alert occurrence>",
+    "data": {
+        "series": [
+            {
+                "name": "<measurement name of the alert metric>",
+                "tags": {
+                    "<tag name>": "<tag value>"
+                },
+                "columns": [
+                    "<column name>"
+                ],
+                "values": [
+                    [
+                        "<values of each column name>"
+                    ]
+                ]
+            }
+        ]
+    }
+}
+``` 
+
+* message - currently, this is always set to "TRUE"
+* id - trigger ID as defined in the alert specification document
+* level - the level of the alert; currently all alerts that trigger have their level set as CRITICAL
+* previousLevel - the previous level of the alert
+* details - a string in the format "db=<db_name>,sfc=<sfc_id>,sfci=<sfc_instance_id>,policy=<policy_id>" providing context of the alert
+* duration - integer, duration of the alert in nanoseconds
+* time - timestamp of the point that triggered the alert
+* data - describes the point(s) that triggered the alert
+* data.series.name - the name of the measurement
+* data.series.tags - (OPTIONAL) key-value pairs for all measurement tags
+* data.series.columns - list of column names
+* data.series.values - list of list of values, each nested list represents a measurement point and the values for each column