You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: explore-analyze/alerts-cases/alerts/rule-type-es-query.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -70,7 +70,7 @@ When you create an {{es}} query rule, your choice of query type affects the info
70
70
{applies_to}`stack: ga 9.2` If you use {{esql}}, specify a time field and how to group alerts.
71
71
72
72
Time field
73
-
:Specify the time field to use when query results are filtered by the time window that you specify for the rule. You can choose any time field that's availble on the index you're querying, for example, the `@timestamp` field.
73
+
:Choose the time field to use when filtering query results by the time window that you later specify for the rule. You can choose any time field that's availble on the index you're querying, for example, the `@timestamp` field.
74
74
75
75
Alert group
76
76
: Select **Create an alert if matches are found** to create a single alert for multiple events matching the {{esql}} query. Select **Create an alert for each row** to create a separate alert for each event that matches the {{esql}} query. Whenever possible, each alert will have a unique ID.
0 commit comments