Skip to content

[Request][Serverless][8.16] Document the new kibana.alert.rule.execution.type field being added for manual runs #5940

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Oct 23, 2024
Merged

[Request][Serverless][8.16] Document the new kibana.alert.rule.execution.type field being added for manual runs #5940

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
770ece2
First draft
nastasha-solomon Oct 16, 2024
ef22832
Swapped underscore with period
nastasha-solomon Oct 17, 2024
1afd051
Merge branch 'main' into issue-5922-exec-type-field
nastasha-solomon Oct 17, 2024
03641d2
Merge branch 'main' into issue-5922-exec-type-field
nastasha-solomon Oct 21, 2024
146abc3
Merge branch 'main' into issue-5922-exec-type-field
nastasha-solomon Oct 23, 2024
e876523
Merge branch 'main' into issue-5922-exec-type-field
nastasha-solomon Oct 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion docs/reference/alert-schema.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,9 +195,15 @@ Type: string[]

Shows the alert’s estimated timestamp, had the alert been created when the source event initially occurred. The value in this field is determined by the way the rule was run:

* **Scheduled run**: Alerts created by scheduled runs have the same timestamp as the `kibana.alert.rule.execution.timestamp` field, which shows when the rule was executed.
* **Scheduled run**: Alerts created by scheduled runs have the same timestamp as the `@timestamp` field, which shows when the alert was created.
* **Manual run**: Alerts created by manual runs have a timestamp that falls within the time range specified for the manual run. For example, if you set a rule to manually run on event data from `10/01/2024 05:00 PM` to `10/07/2024 05:00 PM`, the `kibana.alert.intended_timestamp` value will be a date and time within that range.

Type: date

|N/A | `kibana.alert.rule.execution.type` a|

Shows if an alert was created by a manual run or a scheduled run. The value can be `manual` or `scheduled`.

Type: keyword

|==============================================
16 changes: 12 additions & 4 deletions docs/serverless/alerts/alert-schema.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -891,7 +891,7 @@ The non-ECS fields listed below are beta and subject to change.

</DocCell>
</DocRow>
<DocRow>
<DocRow>
<DocCell>`kibana.alert.workflow_assignee_ids`</DocCell>
<DocCell>
List of users assigned to an alert.
Expand All @@ -904,17 +904,25 @@ The non-ECS fields listed below are beta and subject to change.

</DocCell>
</DocRow>
<DocRow>
<DocRow>
<DocCell> `kibana.alert.intended_timestamp`</DocCell>
<DocCell>
Shows the alert’s estimated timestamp, had the alert been created when the source event initially occurred. The value in this field is determined by the way the rule was run:

* **Scheduled run**: Alerts created by scheduled runs have the same timestamp as the `kibana.alert.rule.execution.timestamp` field, which shows when the rule was executed.
* **Scheduled run**: Alerts created by scheduled runs have the same timestamp as the `@timestamp` field, which shows when the alert was created.
* **Manual run**: Alerts created by manual runs have a timestamp that falls within the time range specified for the manual run. For example, if you set a rule to manually run on event data from `10/01/2024 05:00 PM` to `10/07/2024 05:00 PM`, the `kibana.alert.intended_timestamp` value will be a date and time within that range.


Type: date

</DocCell>
</DocRow>
<DocRow>
<DocCell> `kibana.alert.rule.execution.type`</DocCell>
<DocCell>
Shows if an alert was created by a manual run or a scheduled run. The value can be `manual` or `scheduled`.

Type: keyword

</DocCell>
</DocRow>
</DocTable>
Loading