The source plugins could use an alias for each source plugin instead of generic "event" key. That would be useful and would allow to the customer dealing easily with multiple sources, or the same source multiple times because the only way to differentiate multiple sources depends on the event content.

It makes easier not only for writing rules, if the customer has multiple sources, reading the rulebook can be hard because you can not know easily with condition applies to which event source.

Also must be considered possible collisions between source plugins. url_check adds a root key with the plugin name, but others like alertmanager pushes an event like {"payload":

, "meta": {...}} Multiple plugins could share part of the data structure or some key in the event, forcing to the user to write long and complex conditions, even that could not be possible if the event data doesn't contain enough info to differentiate the source.

For example,
If I want a rule based on multiple url checks I can do something like:

- name: test
  hosts: all
  sources:
    - ansible.eda.url_check:
        urls:
          - http://localhost:3000/donotexist.html
          - http://localhost:3001/donotexist.html
  rules:
    - name: Trigger if both are down
      condition:
        all:
          - event.url_check.status == "down" and event.url_check.url == "http://localhost:3000/donotexist.html"
          - event.url_check.status == "down" and event.url_check.url == "http://localhost:3001/donotexist.html"
      action:
        run_module:
          name: ansible.builtin.debug
          module_args:
              var: events

The equivalent case with others plugins, like for example the alertmanager which contains a bigger and more complex payload, can be a bit crazy.

If ansible-rulebook takes the name as alias for the event makes it simpler:

---
- name: test
  hosts: all
  sources:
    - name: frontend
      ansible.eda.url_check:
        urls:
          - http://localhost:3001/donotexist.html

    - name: backend
      ansible.eda.url_check:
        urls:
          - http://localhost:3000/donotexist.html
  rules:
    - name: Trigger if both are down
      condition:
        all:
          - backend.url_check.status == "down"
          - frontend.url_check.status == "down" 
      action:
        run_module:
          name: ansible.builtin.debug
          module_args:
              var: events