Skip to content

Commit 0dd583b

Browse files
Add kibana.alert.original_data_stream to the list of alert schema fields
1 parent 5e76db5 commit 0dd583b

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

reference/security/fields-and-object-schemas/alert-schema.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ The non-ECS fields listed below are beta and subject to change.
7777
| `kibana.alert.ancestors.*` | Type: object |
7878
| `kibana.alert.depth` | Type: Long |
7979
| `kibana.alert.new_terms` | The value of the new term that generated this alert.<br>Type: keyword |
80+
| `kibana.alert.original_data_stream.*` {applies_to}`stack: ga 9.1`| Data stream information from the original source event, including `dataset`, `namespace`, and `type` fields.<br>Type: object |
8081
| `kibana.alert.original_event.*` | Type: object |
8182
| `kibana.alert.original_time` | The value copied from the source event (`@timestamp`).<br>Type: date |
8283
| `kibana.alert.reason` | Type: keyword |

0 commit comments

Comments
 (0)