Skip to content

Commit 0fd61bf

Browse files
nastasha-solomonmergify[bot]
authored andcommitted
[Request][Serverless][8.16] Document the new kibana.alert.rule.execution.type field being added for manual runs (#5940)
* First draft * Swapped underscore with period (cherry picked from commit c73c723) # Conflicts: # docs/serverless/alerts/alert-schema.mdx
1 parent 1f0d645 commit 0fd61bf

File tree

2 files changed

+935
-1
lines changed

2 files changed

+935
-1
lines changed

docs/reference/alert-schema.asciidoc

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,9 +195,15 @@ Type: string[]
195195

196196
Shows the alert’s estimated timestamp, had the alert been created when the source event initially occurred. The value in this field is determined by the way the rule was run:
197197

198-
* **Scheduled run**: Alerts created by scheduled runs have the same timestamp as the `kibana.alert.rule.execution.timestamp` field, which shows when the rule was executed.
198+
* **Scheduled run**: Alerts created by scheduled runs have the same timestamp as the `@timestamp` field, which shows when the alert was created.
199199
* **Manual run**: Alerts created by manual runs have a timestamp that falls within the time range specified for the manual run. For example, if you set a rule to manually run on event data from `10/01/2024 05:00 PM` to `10/07/2024 05:00 PM`, the `kibana.alert.intended_timestamp` value will be a date and time within that range.
200200

201201
Type: date
202202

203+
|N/A | `kibana.alert.rule.execution.type` a|
204+
205+
Shows if an alert was created by a manual run or a scheduled run. The value can be `manual` or `scheduled`.
206+
207+
Type: keyword
208+
203209
|==============================================

0 commit comments

Comments
 (0)