Currently the ILM policy we create for the alerting event log has a dot prefix - eg, .kibana-event-log-policy. Since the design is that customers should be able to customize this policy, it probably shouldn't have a dot prefix, and be named kibana-event-log-policy instead.
We should look to see how APM is dealing with this also, since I believe they also create an ILM policy.