From e2c2d1fce01c9326e49f57de290b119e487381ed Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Thu, 17 Oct 2024 22:55:09 -0400 Subject: [PATCH] First draft --- docs/getting-started/advanced-setting.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started/advanced-setting.asciidoc b/docs/getting-started/advanced-setting.asciidoc index 02b838b604..b1e10980c0 100644 --- a/docs/getting-started/advanced-setting.asciidoc +++ b/docs/getting-started/advanced-setting.asciidoc @@ -182,7 +182,7 @@ The `securitySolution:alertTags` field determines which options display in the a To ensure rules don't search cold and frozen data when executing, specify cold and frozen {ref}/data-tiers.html[data tiers] in the `excludedDataTiersForRuleExecution` field. Multiple data tiers must be separated by commas, for example: `data_frozen`, `data_cold`. This setting is turned off by default; turning it on can improve rule performance and reduce execution time. -This setting does not apply to {esql} or {ml} rules. +This setting does not apply to {ml} rules. [TIP] ====