Why did elastalert2 send an expired alarm message?

[userzhangqg]

When I reopened the alert rules, I received a alert message before closed. What is the reason for this？
my configuration:

elastalert_config: |
    rules_folder: /opt/elastalert/rules
    scan_subdirectories: true
    run_every:
      seconds: 30
    buffer_time:
      minutes: 15
    es_host: xxx
    es_port: 9200
    es_conn_timeout: 120
    es_username: xxx
    es_password: xxx
    writeback_index: elastalert2-env-uat
    use_ssl: false
    alert_time_limit:
      minutes: 2880
    disable_rules_on_error: false

alert rule configuration:

name: xjtest0925-copy-2024102817
    alert:
    - alertmanager
    filter:
    - bool:
        filter:
          match_phrase:
            project:
              query: log
        must:
          query_string:
            analyze_wildcard: true
            default_field: '*'
            query: info
    index: xxx.xxx.uat-%Y.%m.%d
    is_enabled: true
    num_events: 1
    runevery:
      seconds: 30
    timeframe:
      minutes: 15
    timestamp_field: '@timestamp'
    timestamp_type: iso
    type: frequency
    use_strftime_index: true
    ignore_null: true
    alertmanager_hosts:
    - http://alertmanager-main.kubesphere-monitoring-system:9093
    alertmanager_api_version: v1
    alertmanager_alertname: xjtest0925-copy-2024102817-xxx
    alertmanager_annotations:
      aliasName: ""
    alertmanager_labels:
      cluster_id: logging
      raw_rule: xjtest0925-copy-2024102817
      severity: warning
      source_id: 824e6872-4bc8-41b2-82d1-56a473b6f7e6
    alertmanager_fields:
      env: env
      host_name: host.name
      hostname: hostname
      log: log
      log_file_path: log.file.path
      logPath: logPath
      message: message
      num_hits: num_hits
      num_matches: num_matches
      project: project
      service: service
      timestamp: '@timestamp'
      trace_id: trace_id

[jertel]

When I reopened the alert rules, I received a alert message before closed. What is the reason for this？

I don't understand this question. What does "before closed" mean?