From 640e59c4183300d3371cde0601b91510e1992002 Mon Sep 17 00:00:00 2001
From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>
Date: Mon, 20 May 2024 18:59:34 -0400
Subject: [PATCH] [BUG][8.14] Help icon that opens in-product ES|QL docs has
 changed (#5236)

* rule docs

* Adding image

* Updating file name
---
 docs/detections/images/esql-help-ref-button.png | Bin 0 -> 5959 bytes
 docs/detections/images/esql-ref-button.png      | Bin 3453 -> 0 bytes
 docs/detections/rules-ui-create.asciidoc        |   2 +-
 docs/events/images/esql-ref-button.png          | Bin 0 -> 5959 bytes
 docs/events/timeline-ui-overview.asciidoc       |   2 +-
 5 files changed, 2 insertions(+), 2 deletions(-)
 create mode 100644 docs/detections/images/esql-help-ref-button.png
 delete mode 100644 docs/detections/images/esql-ref-button.png
 create mode 100644 docs/events/images/esql-ref-button.png

diff --git a/docs/detections/images/esql-help-ref-button.png b/docs/detections/images/esql-help-ref-button.png
new file mode 100644
index 0000000000000000000000000000000000000000..ac6280085814cf69d4d890c0e5b854e7baf56fdb
GIT binary patch
literal 5959
zcmbVu^;gtU*ZpUPZiE@SM35S~I~9;_5Tv`iks+j{8)>9FhmvkYIt3{uqy`Y_czwR#
zcRhc=d)C@#?{)9K>;7`iT02@@RUQwU0viATJVgaL&3~->5Biws|GJA25D5U-2s>F>
zbwycOI(2s!Ydc3P08ofd%fL|AG9ZN`1Aad*WDKWgym+a=1WzS=%N*)i|16nMCYqap
zIVxs+8=EyI3bUN8gSE)?a}+gBIShQ+LH7~f!9n6!eosIa+WB<<B>9xp?$PbD-oBS}
zx4SO72a+mvAKd2CCx?3`X%n3wRTAPpmi<Hrp)-TL3a}i7)^NFbVK6c}o{}dH+7qy?
z(MBUh!e1ovsjB?+n%oE|;0h=9BVY3jSEIMcWJ^~7Ngc}`MJSbQyE)5dvPxsiU7rcz
zy!7+UA!Z_r%R7z6wRv6*0`dm86i|W0SVB?p6gH{t#6UvCv$Jse@Fbhfq`dCTNUmhk
z%;ys3;UhnJiGrhETpLcv`6=Ve)9sD5C}Xb6XFgZ`Y59<!|1((0|C1wYBo>dtSTfvI
z?uD21l@=++m_e!#lV{9_FIZ1ls_AHQD%^r$P{|>&c(uep=kGb2EUHAe4LfedN24se
zHrKC}8!X-0#PpKGhjPs0Ek){J{BNAqcAIw2no?d^lnQB)iQB~RYQ6|94bpe-lq2D&
z%jZ15%9}i7G70b>COCvP?s$}pC4tUcJW3DuK4#8w^P2CpoLx(F&q-*w2RF<c<|*Zn
zyu8{gyZL%dp7rd!UDHxlbqX&fcmSemx(o?3-6Ytj!!8D~Bm(%SC^B^5K$hT@YZ|ob
zp>0^SdLpcZH%V)_tm&1}VV0*Tr6>k4JazOd-B&(a=p*6rZL^aTKX6huJUpzbwh9&n
z38e!-!~5^n2msgt0pBNGt&%4cSFhb<PQdi;l<G;VQlw;HUQ@IqII$~=aW5%qs5&9m
zcCSn?+87;mMIg&4s7hLb88y34Kpo#ZtZS1_2pk{w+7;ahRj&_k8tViuUx0BDmSIX3
z2z(|)-J;`>3*mb%K1$XYenf}<3v?sXr!EA+V3YzYppF$#*|KY6LS=WRY04=?&~rmM
zWR?mz_CfPFc+xI~oLty1`?U2j1VU{3a5J$m`jSq;`T%E0)0UVou@SmnU*s10HGLpT
zH_BBn=hicb6ib0Eb5JTYCd9l@M&qoUAr-ZSNC(dPN~h3X<6F7zJi9i*0rY^E;$vyS
zZ(FuzN)dqi!){SVfnJed!Pgm#8NB_k`-c0*7hJcZ5wSDF`sPO5j>@ptaD$k!kyP_b
zivw;wE+4LkOagsadIbNFhy_Z$+cM<H{RsU?)sgxVjKEoqr0&~t{UoH6Bgz38=~HyO
zX`^l%X#3OVY$SO?Yz(T4Y#q4U`gulwPZ7xSNcc$AO(_YdWn?Cf#i|Wg2PY)HVx~WO
z!AI;&bc^*_4qC)AlS`(k{Ji#M`ZI@Uy{Lp}Bm@G%g&0A0SuvsR&~ZpSYctCQYv9X@
zWS9bMHZVE1IocEM8FB%?h*y4@o!B*cX3645-2N#r`abnuF{#M5W>ohVORZ+Lx}*A$
zZeWd^I*+b7E4%i%E~}16p{LgGG#=>{xvY{24dV)<!oW8-dFN5suZDCPwHe=8g^fQ?
zb6^dt6w)EqG11Ah&pR+)P^t`qK!y_gi(FY8Sninhm>;xZ3#sF!rRq2p^5xX?X8bz*
z7%jFfR`yVPn+1Pc=1*90DoUTBGx2jLv)$!~<-7|w2Zsv|3!Mv+_7l^mvzrbO+j+aS
znd>6OrHcjSg|(uU@*6pv8mmHnJ%@@#jvBVNb=K-OZQnL0nKRu2hh?4gS7k(v0@^Q)
zkG+qdQNN=Orf!(T&s7qs^R(+Q?qKO)?AY^+ykPdH@t5f$>iXl)xo_|JQasN1b&oRb
z;?g3)bjEMw404*5pNl_=N8du-=5#R8c9ct*2gdElO(ihPi_JaGUCHfltITCh#zg5N
z=*<6UYi>_u(KuN=V>zuokm~fw>8-`>a;)R79b&M0{0Jeum}8b_-#zzb4vcVZRzQ^3
zx7lGCiWp$C`@Hr3HaOv##q!C3|4$xtEXFR)PRC-wL8S>FVQlfk_Q5}Wruy2z(7I*v
z*7>JxignY}Zc<I9Q^7ICs`YBCH;K1VCwAxRrDcHRozA7or3)2|`WnBJ>O@qNN|tI#
z7$NlD!`(YsXh8%|m{OQYNKa(LLY>?!7B5zSH1=cbSJn((j{JAIMkTc)@1ES7+?BjU
ze+dY!dI|(zcCQ4Tpr24(iJyqmcqX7Gn27m{{S_C^)5)9qg4^Y5eAk7ZxjO;bHQRM?
zp>&D%>AI3nXLCS13?&#J*(mER8_-)29B*B_s>lz?@2wklS>BilZh!g!C`+mLro#gq
zsRc6LeWStm#5a28D;x!ZJkzGRfGyMO6RlB!BT*w9@%+R_eB*6ZEtoN_BAxMqh^#3P
z3`ZA6M{D)%P>=k`)rh_D*4OIvB(JDqt_gor8$fQD$6;?s7Kmyf;*uRAw-&K#%5KVP
zN7c*F2Epy-?Ql1hv$pH~>xZ)!e**WMvX>+`+}=Olcj73M!VF!V3K#pEKiH76uy4ae
zlHiI_ibAQUX~g3d+p!Fd#B9Wo?XVN?6Qw-Tx^TfkpFPq)7|ClXF)8S1C!sZ=g_cvl
zW`F6)q}Ll=zhtDd@);kQpPomlu(0E{^ZI>#5q_aXucJ}9e{TL`=qrg&H2cuab{=D`
z5`vvP9aZttMv5GV=TotEv9Ntc*4X>xzt;Yix|Z+XQgmGm@}yZ6SsfdY7#udCH$F55
zzl%4Xe7BzbIloDy%m>Y5C@*b#d@zl@3RiEZ=3wgYlz7{xHW9DCE)I^1kUGB}0c$6Z
zJXK?7;|;Y($%S8RyGrNC8V|$PJDZEC{(RBJ)w+#_#{f{>rhlP|ncdbB-WuML;CE-(
zst|(3PD?&XYo_+w^0%UIKCQma!ur*kIq%k5`7Iq}vAT*2emx*wt=6WAq@Jv+u5qlc
zYmpc&HV@d2>{6S2P5Fw{_SKu$vDd4uyKhTrZ3@U(s{Q^$q!Y&{_~zC1*9Y;(0E$ZG
z$~RZ$SJo#%-JJd=hjp<gRaXwjoNG_V@O`PNzSFRbs@$q70y|pP$`A)je%Z)9+7q#D
zkK&5ON^dpln%YxlAy(1bZT<d+&XKVA)*REEa&f!B#>PBNlWBn8k{?&_rQjvs5WiP0
zw%Ee#(V|iC_uGpQ-dh{i$;w=I5qYr;ALpaM%bO&eZJas|Y>vwon7yAT%jN9xR}W4f
zBdm^D?*-&RiLUkGjldOxcgd(Ow_~zx-FM*kYuQeVfCrcOo&_HvFTOR;?v?r9vny--
zorgxPHdjN260NoC)*Ib!Hj}xvof<yKjqKpMJqhIFW>_<Z3yrk|RZ!|3*`Kz}=<}4>
zvhQkD?**T_YDX&e9P89v?wX=(5^mdqIG;wZe>w!Odz}B71$BiSNO$(}%D$J)<=pMs
z4`z8Ue9QWzmL|z&lHDb7ld)uSJkT)k;KJZCyzcB<c5~7j5P8M^!t8~bWN|RrgZ`=F
zpSixN*r^&5^KRT&j)$1Lx0m1U4gXvfAQMJrM}`NfuxyH;QqNIT-+(udLBOaRpq@w*
zD&*2wmPcrNE@>Lt8@xT%9Uzkfl)swybr|dbdNnLFe}M~rq4oM2LVlx}1_az>9t1P_
z|8<*r^$6Wn1WBJhZVgAaZ_@Itj6A7dN%E5=8~~3MPiUC6xRvPMk&pj^tfQ5_qP2<&
z!1_;P0;nJg0PUXw{euLE^1u2uh#5fnf9GHTh_nMx|JS4XkN;DN|L~tT|DVAH;Qu;w
z3sC;6_5Wj?h&O=$BP>@10}lWoVf+t3ikb|k0D#k@C?~D$3p&nra-kf7ei%t+&sxlW
zrHC+U5m*ya*ea5eV3ZW^DLjrO*~cN8|FG4p3Sskav5H7$*^}_`E&ltdIDL)$4f-Xx
zicxPZYlYWlvdhEfa=7Y;AX3(1>{+IwvAI^ki)kP`8WXP`uRe=#RNHZ28GTt9(~=co
z=7{3>5|szK%7p+45QDQ~oXA#zY^)IFA%R#Y__uJWQgat;R-YpC02}1Mm>uWE<mCP1
z^}|Fr!KCBl<Qk?&t9Ad{Hv`cr^llT<PTgMc!O5YC%-*m0v)`TpW>4h~8yk3oRs24@
z)f`ii|3<vtTHfLDR%|j2fl9Y=?@l4|!)NQ)4+9~wlL*?Y_<?LyT78uHkd`L`9yko#
z*~mppV%WOvc9-7dI~_FF=3VmdgQkqgt(_^CoC?v%-1@GoMY#BxjSmY~Z$K9_o|Tlf
zO%g~{8C}SwdJQYzr6!!Ir=2oyx!q~0ZoCw`nhg7eFmSd)fPsG0fYNEh)7yuvwB7yi
zQXbEllREO}`<2w5m2M9!+-~k~{G3u@h433%Q5WQh8Er|yo;#iTj0&G;YGGIE*aMmB
zkrB2sk$@hlgk^o2FgxXsbGe$$KG5c!Ufn>C$<YVoqfIYGn=R`Es?<f&RxCSWmwr{5
zN!|bzak$f~?nRg!`h|<$lxr!P53xu}?R!wgL;rdqXyvIC3@doNS<R=??%nAFg+_*D
z89Lx-5Z}dydJ%lbF*_qN{fvIqKN%7i4oa4x_S_5+9ctY=3$vQrfMN*wK$4*P+<y%%
z_9gR>5y;0L<izpcbx{ui-M3p?T_t}ooDKKGTXvn}pb|4~p6ENzYWwERG5Q^;7+;`{
zjM@O*Hj^Br9!+4jQZQ@mwkXAT{nMJ*6=_c=WuAn6K7oc}-;wggMFyVW1FbbNnqv)T
zo2rZ9sBSvdLFwn#tBu>fuKARY?FR6)E6JsK2`xV|F@D&?&jEfE@4qNmn@=g3O4x-9
znqLB}%qFD=vc4@_72z+LT5wbk3Fxt#*W<TaG`Pk`zalY(=J!+dLbX7Dt0dP5)Mya{
zp98*{{d7Lmq>fXMyVAo&-@H54_3aLV{M`9r;eta)oV&>|<L)WZ!iaX6Qz7}zH<$|g
zY5X*@0)Bfj^S0!9`8g1ZGF6*6KG5)7OP`wz*|W*pFlyQ>i$A@Vf!-)jOOl*qL8i0L
zP{4$S7@hBV@EKXbrV}FJOWPvQn&GE;<k9kr2>=y$@gaGu>f&w;|9pJ$u>k)dd4}5-
z=HAO(WE6|k8P^ilnY0VBiZZZZ1c4W_>{YQ<tgiJI_)f~c^hn;V43uIXIZb&#tjjRz
zqx%jtzBMYVZ6WO2c@Ib1>{@z9aEG}vnyAB4hh1>1;%=Iy@k|t3J2PhQ>AdOh>FMLF
z{--zOL+A8#+&T0HP0m|7&^nG?B6BlaqzSC{B`mBxXM{y<GfspFr2AF@C98B+-?71K
zq)X!8!nCP^>CDJ6^35{%lBaZ3CK#O=2aCF<f(I+SA9#<4#%8;<HDr=YvWiIhdC0$4
zD$iLpG5^pK`&mA%jpz4};7eMnyKwO5?)H-sgH(8t`#X2BNVokLDm`@`s{Q&dnRvl6
zWD;LJQc!15lxG#ZaE~ncm~*47QQqj(=>9P0xY8V6*T~`HqK_h)4t_0%t%UBVfdfTL
zq}=&aj1KrZP$_YP@PXqU92ZIFn}z}1FP~#HLX`$O*V~5h?t|D(&4~P8wKaN>QG;3(
z43k1cdixb*Sb<>;yRitPeui0k)F_uR&%&DHlAr|qHMK<f`ezsp@~<daZRXoa>iHsy
zF))<a8b_lthw4z^<0*Q`+;2A}ZXQ^y@-}HqHC99@qheusWpA1b&(U)aK@I~E=zgDZ
zE%{<!^M3u_7O<KnP(Ew6l*6CyCnDUnUo73jcv4(zKm;PrY))6*gZCMQRs3=rOJ0b>
zKL9xZ^~)pDE-0)6Bx>;}luM9z(;A;+Mck|HSVR<(WXsX2N74qf7Uy8s!o<~ALvW2v
z$P-h|y72z;L4S8s>GjjOjrq37OvJbaHxcz-!7-Br*r~%|2K>1!egTY79U2NKS>QCL
z{tz70<Is1fakfDlbn<=w`n)MFp*A6)kc=Q@fbr;!m10Pmw=ha9o(}tD{RHJ5?xFeX
z9c2NM=e+PKAICXx;Iht=Yv|;1`_@f_;-LaItixa8#Q`U7{2W(v9HEnwhGGht*Qj(U
z_WFq3Tyc*I_EB-1>#n|Ij9|B)#crSi4NZPHsX*jNrk9ubdGM@#slSP)DS2KD%15_j
zE4AV__c3cb0!NDK=W2n`4dHR<@86_D^Z~Or);HzYavIrRuM)Q%tfqV2#REAJVNr$g
z3!R;+-<D3-J0yy(6<XkbX<j-r;y2TH4-+k=e+g*lKfDkgu9=|viOM9Aa6EC=h9Kc9
zT>PQTzVdoZT3JB>A})kiLyNz2f@=MCsM=`!_5gGky`M?k3sSTQYE_g}VvtX5oT(V^
zFoj`dwhbhCGH6*VXpPwaV0Ssmx|dmdJ3+LNOR?zJ=7v<sN~?lGM?cQeg$6WZ(M4lx
zT15||m5n3qUSQ>mtI@nuAesF5V8Ml`T`;d^y+VgBmZmcLU&?myGc2TSSHmcj4x9NS
z|J_lbYK@Ji<em#H7J(NNr`dAId08z{BFebDa>k1+ewIhy=p0a3?u$F>kkov6z4zVT
zs-&Kw_qEflFCNQ?zc|4+qC3Ihpl2jc<V$lv@pvZ&e0)OPp!xhUvcti12wxF=RL{?_
z*tblK6Q+40?=|ebeMv_XksJ1BR}6IhtGQ>V{yOzxs++=r4b?Gu4qr~8FjvHDX+K8i
zB}jKh+7B<fH=CM?L5nMy-D@d1CXV*1$tUV}Hv^!4cr;J06HH_Zr7kEjx%Xbs_t*`n
zRVbpv0I;h}1%{0)SwAVkuyAIOVXZ$3*}83SDyau_Ii`b}^TvRJqNjSn^e#dg7mfhx
zKs75xxQ>M_*&U#-Jm^XymY9PFe68fl_#m-}Xr9uU&?6U_1BC}jpimJm&!Mk}Fe70$
z2ww>gD%bq+{9ic`{RDhRS^z$*7dKisyas~x>9d<!>#q5VO?>po&Db=hzcXs7GhGgA
z+<;?BuhZ(zR&cf4<D=$Ib&$Wnl5sV8ql8^eApm;=SbFDeib*W9N-~IP`pvo?vrYd!
z&wAG9vh$EtOsK?rA8la9@q{w3czKw9NcmSBr#^-Va}Y!nCd?J}jyF)E35#GNW-Plc
zp*OM_?};a@WNUz?cvRh~+f<226tkoP9@D2;1b7_@-FZbWNbdWSm=19r%UiWUX{RI0
zxXV|k;7*r)HVUeZCIu7fz>wXWjo<3;QOf6hF~9{)09%BeWF=CFd#|7HSD_hn^W1N}
zS>-E-uTL!s;Lf9bHEl;E?(dhC#2r-#S7hQ1jndz5mJ~O>8ZC+WLp3;9xzyOLWJpy6
zMC?L0dbZ!9a=pfZ_xg09h{EortFolshK=0Oxl+%WWnCmBRvI5HvrKY`PYuYb`iG2)
z&}ay!UAd@6;hETXfWeqs1UF8UqYi~-Zi)~;v>w+>xRhSDLhBQD!Qeo9R^_ENnr_;D
zbsHq|gH!gU`NVW)E3zw|MNDe9^ZlMA>-|}hDfIyP+$b|IgsJ4JZC{%qWJ7u2U*eMV
zed;r1aqKsxbgMLOlBaCofxmA!l{aAb0#d@O%xwz|9=WTA)7j>H;IgDG?})MBB?|D7
zYy=A)8-d@Cx~85#R``l<aoI4qA&Q?6DrpV=ZS)>qaZN>_p&TnFoqP8DX!_|%#SIG1
zjEwWUG%oLDl+-LE{HpP*8R>d$&4R2Y9j@jz1e=*-`?Fh#*s<HEGS6-W!Js!akEq|j
t1KAZR6sDA>yw4LWmLnSe59v4<jlwZ@qk2oV|35ij@s+Avt&C~t{{U;9B;)`9

literal 0
HcmV?d00001

diff --git a/docs/detections/images/esql-ref-button.png b/docs/detections/images/esql-ref-button.png
deleted file mode 100644
index 0907eb64419048cc8d1b383dd5896621fab8b62f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 3453
zcmV-@4TAECP)<h;3K|Lk000e1NJLTq001HY001Zm1^@s6o7^a*000WJX+uL$Nkc;*
zP;zf(X>4Tx07!|Imj_f+=@Nkdd(%TgONfA!(3|uYKuQQLfP!?e5t0x>i7_OA*iczq
z!HS9qmK9wUQLs_OhKOQY6cn&8$RePuiv>|pc^5bYci(yMoj2#qnJ<(1XXd}>|L>U#
z0GY}Wi&J4`0MbNKNtnMkJtj7ej_U(NppGaRm~y!3VrFP)FhFF={#`zH0BGFaw;a#)
z@BjZ-QQ`5^xd1?+2q*B;xoHTWMRbTOmPi3W9YXvDnNsmM-$0luK^jE(={O4}d1#yy
zCK!#Lh=~YeA*>Dnp2Xou1OSi>5kEbHD?sv)d=Rz~@q{9Tk>9{0Eo})8VWciFMPkGV
zkLPD3{E$cRx10&`oE(lo&XaqY5WJ5tU7X5U_J2N(|1D{$vZ)%zh?0^d0bz(m`hp&&
zED4gcC}D2M6bpG1@e`aR3y7RzZaOP&ig_HLAo<$VxxrJMDD-2?^GMkdQ_N5I4WDAk
zk}!F#L<x&I#T?0WU0F(`+@Hi}%kyU^MMO_=hA?XG6sM<z2TjMY<bH`POx{0V<nKLQ
z*H6CpwDceLD`d;pN|Pc2<a_5#_s<tGr*o#q$a~}QeSD{5BIWU7skgkAI5kur&rkK2
z`_nVR<!hzLft+3&Du0H_oWRg22Eo7|&_N_f1yUdZ9N-6pKm_<we%AOI1*|3FWfGwv
zNlIrTw~S9`i?~*^=yo=C_5h6E*~ugEo;Gn8A=<5J-@0-D+|P}Tjh&zN1>OVTR6GF0
z>S>?pLI9Ne0Jw31E0bhQ`o^ylz#wk|B|rrlKnEBAQ(y_~fD>>7UceUwf)Ee^V!<N7
z1xX+c={ysx0Bb-VC;(f*PEZ2&gM;8GH~~(BT5the0oTE8a1XSDC!h=Tg4bXOd<3Hq
z1mPeuM1eFQUC0Qsfb1X!<N^6Y!B7|!3&leMNCe5C70^1U04jt^paW1jbP75LU4d>w
zt<WQ=8ybM#L0@1LOoFMfHf#)A!wi@S2f-2WLRbJVg|p#Ycr#oKm%+#38u$u)8*YcY
z;Medl3ZN8FG?X6762(BVP$8%|R3b`(T7}9-6`{&dm8g1DGwMF73pI%PjK-oVXgb;w
z?S>9ON20mtrRY`Yjp!2eQFINu34I^kjUGaO$B;2v7z>OmhK-5A2r!wLJWLVhFs2%F
z4bzV4#eBqKu{5j+))^asjm0Komt!|#_hPHC4cJy}4|W)b!)f3waPGJe90w=G<>7YY
zj^i%l+Hk$NPk05qF5V9BhmXUH@N4l!_+$7>_%?hWew3h0Fe11TLI^y<GQt+ZAwoUj
zE}@q&N>m}55Z#Fp#AM<cVllCjc#Zg!_+CLlL0`c|VV;6eAxEKD;iSS1g>Hq<Bvq0*
ziA7pKl94u(j*uEik4W#yWU?{YiyTLmk~fpf$ydqG$)6M{idKqjMV{hn#Ztu@#Wuw^
zN(3b%C8p9MrEH}lr87!*l?Igw%ErnpWsdSH<x=Hy%ALx?Dijr4l@OIQm5nOLRBo#D
ztKw9RRee=?s=2BMRj;b{P*4;D3X8&}tfL&FT%+_-u~ZW(o0?25pq`+%P>0l1)g08K
z)Uwn{)h?=a(NHvF8k?3%+d?}{>!5v^p*@2+gFj=#jLI2pGe*>Bs(Y#P)$`S>)Z5j+
zXwWr$HBvOTY1C>w(?n~UYtGZm)ZC|eO>=N2b*9@)?#%p|r)NIag0;-G!nBra9n`v`
zHLR_p?XNA?-mQIAdr*g_<E4|VvqR^S&VVjO*F#sRyF>S~?kl<)ok>rn7t@>QLwZ_z
z0eUjM19~lbqxvTLk@{=(tMs245Dgdxi3U3i8V!aFbq(hjt}v`Hd~8H8Vi+YE?J{aM
z8ZkC8jy7IzTx;BKqHe-A$u_Ald1^{F^)y{-T4wsd3~R<POEKGPcF!C(cQj8jFEzhw
z0b4j(2rc$nw9dlJa+xKXRW_^Bl4QxW%&@Gm?6#s=1zWAPs<nD!ZD<{5z0JDW`n!#z
zO{&cyn<uuawt=>5ZR>5{*_qpM?Mm$)*pu!3>{r{@*}rwLaNs-ab9m@Tah&70-m%f~
zo0GGX#HrG0z}e6_-g%F6CxgleWo%^JaKX5EyR3G(;PTnk$yMrl+Vw9tOScraV{ZMk
zO=k0FADZ3cuJ6uqKj7ZwLHCIF_{F2kQ_qv*S?2k|%fO50b=a$qX~s-u9%sJsw(*vD
zS9_1JTv;nw4L&Fzf1iAx7GG80NZ%6Q=YINr0>28sA%92z<^Bx;n1G;wZ2_HZZ8n!(
z&K?SM4qO@76hsON4=M?I5o{hT39g?5&k3Bfea_RlMsr1TYePT?J7jyvvrv=JrJ?8N
zVdsU;E1mZ;%r<OASaUcfd~x`(@Q)GR5nCdjM4Cp*A{(QWq83DzM~y`LL>ESP#aPFz
zjJX}F87qvfi^Ii5#T||tp6@$<=ltFUjtlY@bSyMkn6>ccBF#mqi!Lr!TFhB|CLR+X
z9e*tTD<_0g#u-jvC+tZW;<C8AxUYF$ydAs&zB|8=-<Rl~SeV!^a2ISB3?z9b6(tP{
zS;7+G+vI@c{mCOKAt^^v#!{nGtJ3gk@oDEos-hH8(-NH}SxZ{Q7UDc{*HYJ|JC_bg
zf+UC2q4b66by6xa9Nm$b%6^h{XLw|kW_-$w$~=>$k|oNzv&?+ihGl)(e%Ze+M=$3t
zZ(O0bV$F)~mCTg~Rza&0RyD3RSe?7NH^)Ec=o;dhlr_JtwOL!Z_QSg9b@jR0xjDH#
zKl%Suk*Am^$?IJ2wtoN5=%0l@w`{QAuzSPzd|v*o0-J)Og0CC78*gp0-Bi43Y;)q~
zmMu<O_HD&(6>aU<=DF=?p-N$PVbAtC+iP~vcjWK*uygUwn?(*q`*#s{$#!)W2N&1v
zHr%~+_t%o7lJ-*X(yBdLdp7JD*~{D8w$E!{<$mq`1^d7JBK+my0sjLvWyWPi2eAh;
z4!%4Tb*TAQ#;@gvH4hgY{&qxkr0Zzd(WY|e^73O^$F@|!6|#zf;|q@8JK=MpuF|sd
zKoza3;3POHJNfEV{Hc!9L8lwfFwRt-H9EVeno^x#1Jx|68LCaH?W&8dYdsfuuCd;&
zzWTh?`6CzfE|gwWySU{N@lx)kvCG+)ha1EVgI5GsdKwouKDiom^+D6Trj~0#*KS<*
zyMDEq*?jqi`;7}XU2mSd#kf^_+v#@A9mhM>zd8O^-Qv_zbJzK9-949k^{um8FSU8L
zUAgab|M~;=gWK(M+gm##J05l}=<IsPd)WUd_0ikM8IMPw<UGYZ&3~r+tmwJc^RnN~
zey{3s>bltN(|zYf_=_h!+@9Ber2p}?H}@s^Wl^7QUwOY>|Ahg+fqSp!zv_K0emy#v
z_ovFAd)}D7Is2E_Uw4LLhI-#h-j2Q7_+I1vkq-_Z8izxNpMOmII69L5N#oPe&y3H_
zU!uSCjb?tueJ%cG_O1SV(D$cfX=7tzj)XHY3ZM{$6B7Y=cLV@(EC3W_h9J(LoT(=S
zn*0u!An>1fa_*iGCjcrDGd>!z8UQ$nsBsPeN?rhrk3|t)0JgW6>(u-^F{_V@4)U!q
zUkV6<505uJ&H?|B$vOUqzW-^#cvc7SPx~+Ybqtk~Mf;Ti003-dSV?A0O#mtY000O8
z1OXZV1poj50RR91J^>p51poj50RR91Mgb@Q0{{R30RRF30EcM+1ONa40RR91P5=M^
z00000kN^Mx0RR91kN^Mx0RRG^0ssU600031001JO0{{d700031001Ze0000Y;861b
z000SaNLh0L02U<x02U<yNm3;60005_Nkl<ZSPAWzJyrrS5XXbhBgh4m!tK}tV2Rgo
zOKd1S35}L`0(-aR0MKE99ze130Lni)aY(W*$pqNvW13yEN#>XN$RxC0-#<Q81LUXy
z3>u*^Ajdw7j34J}_Oevd#hdSQlD49ssp2v-b2%WxyUA7oNHZ47Wew!w=D~c+J8cbw
z=T-mQv`b%Ri=`Tub7vX@GJXDb0~C)2Jq7oWYx1+UGcdLRAU-j{dS5>IzVEEffRM)S
z=?T5=^yz@aYA4smj!yyth~e!-$JJgz5X=bjZYSQYCTn6>LgSEW5=r732>^{1Sp<6x
z-<)U<qRB&^jj@Ob1i?AF?kN;7sfb)dTYuHI9Req^NQk1kzW);h)mmrLDw{$jxkZr9
zJf$}U5(O()f;~hcNkI77GZrSfYYrf>7O=-TF@j@0FJ?$dTrpA!9mwtZ91wK0JKMkQ
zNmBfFKrm^FBIbkRw@3S~<bYs5NRf^{5S(pcUFe{KN&OrU-*o~p;}aYM><NASsO_&R
zZ9o9viv_HrYRfKE76d{-K0Uu6IDwZ+D}^uN!;sZV?==PlN)e=3J&0kUO+k3N)2i#9
z7{g=HfM6g#!0-FG2d{wu23E)i)s++xZ~GVv;H$$tp;BA)G}upx$3YnvDJuC=<s7zk
f_*apeWA*+8_TaA=LKiI|00000NkvXXu0mjfGWJn^

diff --git a/docs/detections/rules-ui-create.asciidoc b/docs/detections/rules-ui-create.asciidoc
index eb7acda8a4..1ffb0900e1 100644
--- a/docs/detections/rules-ui-create.asciidoc
+++ b/docs/detections/rules-ui-create.asciidoc
@@ -275,7 +275,7 @@ To create an {esql} rule:
 +
 NOTE: Refer to the sections below to learn more about <<esql-rule-query-types,{esql} query types>>, <<esql-query-design,query design considerations>>, and <<esql-rule-limitations,rule limitations>>.
 +
-TIP: Click the help icon (image:images/esql-ref-button.png[Click the ES|QL help icon,20,20]) to open the in-product reference documentation for all {esql} commands and functions.
+TIP: Click the help icon (image:images/esql-help-ref-button.png[Click the ES|QL help icon,20,20]) to open the in-product reference documentation for all {esql} commands and functions.
 +
 . Click *Continue* to <<rule-ui-basic-params, configure basic rule settings>>.
 
diff --git a/docs/events/images/esql-ref-button.png b/docs/events/images/esql-ref-button.png
new file mode 100644
index 0000000000000000000000000000000000000000..ac6280085814cf69d4d890c0e5b854e7baf56fdb
GIT binary patch
literal 5959
zcmbVu^;gtU*ZpUPZiE@SM35S~I~9;_5Tv`iks+j{8)>9FhmvkYIt3{uqy`Y_czwR#
zcRhc=d)C@#?{)9K>;7`iT02@@RUQwU0viATJVgaL&3~->5Biws|GJA25D5U-2s>F>
zbwycOI(2s!Ydc3P08ofd%fL|AG9ZN`1Aad*WDKWgym+a=1WzS=%N*)i|16nMCYqap
zIVxs+8=EyI3bUN8gSE)?a}+gBIShQ+LH7~f!9n6!eosIa+WB<<B>9xp?$PbD-oBS}
zx4SO72a+mvAKd2CCx?3`X%n3wRTAPpmi<Hrp)-TL3a}i7)^NFbVK6c}o{}dH+7qy?
z(MBUh!e1ovsjB?+n%oE|;0h=9BVY3jSEIMcWJ^~7Ngc}`MJSbQyE)5dvPxsiU7rcz
zy!7+UA!Z_r%R7z6wRv6*0`dm86i|W0SVB?p6gH{t#6UvCv$Jse@Fbhfq`dCTNUmhk
z%;ys3;UhnJiGrhETpLcv`6=Ve)9sD5C}Xb6XFgZ`Y59<!|1((0|C1wYBo>dtSTfvI
z?uD21l@=++m_e!#lV{9_FIZ1ls_AHQD%^r$P{|>&c(uep=kGb2EUHAe4LfedN24se
zHrKC}8!X-0#PpKGhjPs0Ek){J{BNAqcAIw2no?d^lnQB)iQB~RYQ6|94bpe-lq2D&
z%jZ15%9}i7G70b>COCvP?s$}pC4tUcJW3DuK4#8w^P2CpoLx(F&q-*w2RF<c<|*Zn
zyu8{gyZL%dp7rd!UDHxlbqX&fcmSemx(o?3-6Ytj!!8D~Bm(%SC^B^5K$hT@YZ|ob
zp>0^SdLpcZH%V)_tm&1}VV0*Tr6>k4JazOd-B&(a=p*6rZL^aTKX6huJUpzbwh9&n
z38e!-!~5^n2msgt0pBNGt&%4cSFhb<PQdi;l<G;VQlw;HUQ@IqII$~=aW5%qs5&9m
zcCSn?+87;mMIg&4s7hLb88y34Kpo#ZtZS1_2pk{w+7;ahRj&_k8tViuUx0BDmSIX3
z2z(|)-J;`>3*mb%K1$XYenf}<3v?sXr!EA+V3YzYppF$#*|KY6LS=WRY04=?&~rmM
zWR?mz_CfPFc+xI~oLty1`?U2j1VU{3a5J$m`jSq;`T%E0)0UVou@SmnU*s10HGLpT
zH_BBn=hicb6ib0Eb5JTYCd9l@M&qoUAr-ZSNC(dPN~h3X<6F7zJi9i*0rY^E;$vyS
zZ(FuzN)dqi!){SVfnJed!Pgm#8NB_k`-c0*7hJcZ5wSDF`sPO5j>@ptaD$k!kyP_b
zivw;wE+4LkOagsadIbNFhy_Z$+cM<H{RsU?)sgxVjKEoqr0&~t{UoH6Bgz38=~HyO
zX`^l%X#3OVY$SO?Yz(T4Y#q4U`gulwPZ7xSNcc$AO(_YdWn?Cf#i|Wg2PY)HVx~WO
z!AI;&bc^*_4qC)AlS`(k{Ji#M`ZI@Uy{Lp}Bm@G%g&0A0SuvsR&~ZpSYctCQYv9X@
zWS9bMHZVE1IocEM8FB%?h*y4@o!B*cX3645-2N#r`abnuF{#M5W>ohVORZ+Lx}*A$
zZeWd^I*+b7E4%i%E~}16p{LgGG#=>{xvY{24dV)<!oW8-dFN5suZDCPwHe=8g^fQ?
zb6^dt6w)EqG11Ah&pR+)P^t`qK!y_gi(FY8Sninhm>;xZ3#sF!rRq2p^5xX?X8bz*
z7%jFfR`yVPn+1Pc=1*90DoUTBGx2jLv)$!~<-7|w2Zsv|3!Mv+_7l^mvzrbO+j+aS
znd>6OrHcjSg|(uU@*6pv8mmHnJ%@@#jvBVNb=K-OZQnL0nKRu2hh?4gS7k(v0@^Q)
zkG+qdQNN=Orf!(T&s7qs^R(+Q?qKO)?AY^+ykPdH@t5f$>iXl)xo_|JQasN1b&oRb
z;?g3)bjEMw404*5pNl_=N8du-=5#R8c9ct*2gdElO(ihPi_JaGUCHfltITCh#zg5N
z=*<6UYi>_u(KuN=V>zuokm~fw>8-`>a;)R79b&M0{0Jeum}8b_-#zzb4vcVZRzQ^3
zx7lGCiWp$C`@Hr3HaOv##q!C3|4$xtEXFR)PRC-wL8S>FVQlfk_Q5}Wruy2z(7I*v
z*7>JxignY}Zc<I9Q^7ICs`YBCH;K1VCwAxRrDcHRozA7or3)2|`WnBJ>O@qNN|tI#
z7$NlD!`(YsXh8%|m{OQYNKa(LLY>?!7B5zSH1=cbSJn((j{JAIMkTc)@1ES7+?BjU
ze+dY!dI|(zcCQ4Tpr24(iJyqmcqX7Gn27m{{S_C^)5)9qg4^Y5eAk7ZxjO;bHQRM?
zp>&D%>AI3nXLCS13?&#J*(mER8_-)29B*B_s>lz?@2wklS>BilZh!g!C`+mLro#gq
zsRc6LeWStm#5a28D;x!ZJkzGRfGyMO6RlB!BT*w9@%+R_eB*6ZEtoN_BAxMqh^#3P
z3`ZA6M{D)%P>=k`)rh_D*4OIvB(JDqt_gor8$fQD$6;?s7Kmyf;*uRAw-&K#%5KVP
zN7c*F2Epy-?Ql1hv$pH~>xZ)!e**WMvX>+`+}=Olcj73M!VF!V3K#pEKiH76uy4ae
zlHiI_ibAQUX~g3d+p!Fd#B9Wo?XVN?6Qw-Tx^TfkpFPq)7|ClXF)8S1C!sZ=g_cvl
zW`F6)q}Ll=zhtDd@);kQpPomlu(0E{^ZI>#5q_aXucJ}9e{TL`=qrg&H2cuab{=D`
z5`vvP9aZttMv5GV=TotEv9Ntc*4X>xzt;Yix|Z+XQgmGm@}yZ6SsfdY7#udCH$F55
zzl%4Xe7BzbIloDy%m>Y5C@*b#d@zl@3RiEZ=3wgYlz7{xHW9DCE)I^1kUGB}0c$6Z
zJXK?7;|;Y($%S8RyGrNC8V|$PJDZEC{(RBJ)w+#_#{f{>rhlP|ncdbB-WuML;CE-(
zst|(3PD?&XYo_+w^0%UIKCQma!ur*kIq%k5`7Iq}vAT*2emx*wt=6WAq@Jv+u5qlc
zYmpc&HV@d2>{6S2P5Fw{_SKu$vDd4uyKhTrZ3@U(s{Q^$q!Y&{_~zC1*9Y;(0E$ZG
z$~RZ$SJo#%-JJd=hjp<gRaXwjoNG_V@O`PNzSFRbs@$q70y|pP$`A)je%Z)9+7q#D
zkK&5ON^dpln%YxlAy(1bZT<d+&XKVA)*REEa&f!B#>PBNlWBn8k{?&_rQjvs5WiP0
zw%Ee#(V|iC_uGpQ-dh{i$;w=I5qYr;ALpaM%bO&eZJas|Y>vwon7yAT%jN9xR}W4f
zBdm^D?*-&RiLUkGjldOxcgd(Ow_~zx-FM*kYuQeVfCrcOo&_HvFTOR;?v?r9vny--
zorgxPHdjN260NoC)*Ib!Hj}xvof<yKjqKpMJqhIFW>_<Z3yrk|RZ!|3*`Kz}=<}4>
zvhQkD?**T_YDX&e9P89v?wX=(5^mdqIG;wZe>w!Odz}B71$BiSNO$(}%D$J)<=pMs
z4`z8Ue9QWzmL|z&lHDb7ld)uSJkT)k;KJZCyzcB<c5~7j5P8M^!t8~bWN|RrgZ`=F
zpSixN*r^&5^KRT&j)$1Lx0m1U4gXvfAQMJrM}`NfuxyH;QqNIT-+(udLBOaRpq@w*
zD&*2wmPcrNE@>Lt8@xT%9Uzkfl)swybr|dbdNnLFe}M~rq4oM2LVlx}1_az>9t1P_
z|8<*r^$6Wn1WBJhZVgAaZ_@Itj6A7dN%E5=8~~3MPiUC6xRvPMk&pj^tfQ5_qP2<&
z!1_;P0;nJg0PUXw{euLE^1u2uh#5fnf9GHTh_nMx|JS4XkN;DN|L~tT|DVAH;Qu;w
z3sC;6_5Wj?h&O=$BP>@10}lWoVf+t3ikb|k0D#k@C?~D$3p&nra-kf7ei%t+&sxlW
zrHC+U5m*ya*ea5eV3ZW^DLjrO*~cN8|FG4p3Sskav5H7$*^}_`E&ltdIDL)$4f-Xx
zicxPZYlYWlvdhEfa=7Y;AX3(1>{+IwvAI^ki)kP`8WXP`uRe=#RNHZ28GTt9(~=co
z=7{3>5|szK%7p+45QDQ~oXA#zY^)IFA%R#Y__uJWQgat;R-YpC02}1Mm>uWE<mCP1
z^}|Fr!KCBl<Qk?&t9Ad{Hv`cr^llT<PTgMc!O5YC%-*m0v)`TpW>4h~8yk3oRs24@
z)f`ii|3<vtTHfLDR%|j2fl9Y=?@l4|!)NQ)4+9~wlL*?Y_<?LyT78uHkd`L`9yko#
z*~mppV%WOvc9-7dI~_FF=3VmdgQkqgt(_^CoC?v%-1@GoMY#BxjSmY~Z$K9_o|Tlf
zO%g~{8C}SwdJQYzr6!!Ir=2oyx!q~0ZoCw`nhg7eFmSd)fPsG0fYNEh)7yuvwB7yi
zQXbEllREO}`<2w5m2M9!+-~k~{G3u@h433%Q5WQh8Er|yo;#iTj0&G;YGGIE*aMmB
zkrB2sk$@hlgk^o2FgxXsbGe$$KG5c!Ufn>C$<YVoqfIYGn=R`Es?<f&RxCSWmwr{5
zN!|bzak$f~?nRg!`h|<$lxr!P53xu}?R!wgL;rdqXyvIC3@doNS<R=??%nAFg+_*D
z89Lx-5Z}dydJ%lbF*_qN{fvIqKN%7i4oa4x_S_5+9ctY=3$vQrfMN*wK$4*P+<y%%
z_9gR>5y;0L<izpcbx{ui-M3p?T_t}ooDKKGTXvn}pb|4~p6ENzYWwERG5Q^;7+;`{
zjM@O*Hj^Br9!+4jQZQ@mwkXAT{nMJ*6=_c=WuAn6K7oc}-;wggMFyVW1FbbNnqv)T
zo2rZ9sBSvdLFwn#tBu>fuKARY?FR6)E6JsK2`xV|F@D&?&jEfE@4qNmn@=g3O4x-9
znqLB}%qFD=vc4@_72z+LT5wbk3Fxt#*W<TaG`Pk`zalY(=J!+dLbX7Dt0dP5)Mya{
zp98*{{d7Lmq>fXMyVAo&-@H54_3aLV{M`9r;eta)oV&>|<L)WZ!iaX6Qz7}zH<$|g
zY5X*@0)Bfj^S0!9`8g1ZGF6*6KG5)7OP`wz*|W*pFlyQ>i$A@Vf!-)jOOl*qL8i0L
zP{4$S7@hBV@EKXbrV}FJOWPvQn&GE;<k9kr2>=y$@gaGu>f&w;|9pJ$u>k)dd4}5-
z=HAO(WE6|k8P^ilnY0VBiZZZZ1c4W_>{YQ<tgiJI_)f~c^hn;V43uIXIZb&#tjjRz
zqx%jtzBMYVZ6WO2c@Ib1>{@z9aEG}vnyAB4hh1>1;%=Iy@k|t3J2PhQ>AdOh>FMLF
z{--zOL+A8#+&T0HP0m|7&^nG?B6BlaqzSC{B`mBxXM{y<GfspFr2AF@C98B+-?71K
zq)X!8!nCP^>CDJ6^35{%lBaZ3CK#O=2aCF<f(I+SA9#<4#%8;<HDr=YvWiIhdC0$4
zD$iLpG5^pK`&mA%jpz4};7eMnyKwO5?)H-sgH(8t`#X2BNVokLDm`@`s{Q&dnRvl6
zWD;LJQc!15lxG#ZaE~ncm~*47QQqj(=>9P0xY8V6*T~`HqK_h)4t_0%t%UBVfdfTL
zq}=&aj1KrZP$_YP@PXqU92ZIFn}z}1FP~#HLX`$O*V~5h?t|D(&4~P8wKaN>QG;3(
z43k1cdixb*Sb<>;yRitPeui0k)F_uR&%&DHlAr|qHMK<f`ezsp@~<daZRXoa>iHsy
zF))<a8b_lthw4z^<0*Q`+;2A}ZXQ^y@-}HqHC99@qheusWpA1b&(U)aK@I~E=zgDZ
zE%{<!^M3u_7O<KnP(Ew6l*6CyCnDUnUo73jcv4(zKm;PrY))6*gZCMQRs3=rOJ0b>
zKL9xZ^~)pDE-0)6Bx>;}luM9z(;A;+Mck|HSVR<(WXsX2N74qf7Uy8s!o<~ALvW2v
z$P-h|y72z;L4S8s>GjjOjrq37OvJbaHxcz-!7-Br*r~%|2K>1!egTY79U2NKS>QCL
z{tz70<Is1fakfDlbn<=w`n)MFp*A6)kc=Q@fbr;!m10Pmw=ha9o(}tD{RHJ5?xFeX
z9c2NM=e+PKAICXx;Iht=Yv|;1`_@f_;-LaItixa8#Q`U7{2W(v9HEnwhGGht*Qj(U
z_WFq3Tyc*I_EB-1>#n|Ij9|B)#crSi4NZPHsX*jNrk9ubdGM@#slSP)DS2KD%15_j
zE4AV__c3cb0!NDK=W2n`4dHR<@86_D^Z~Or);HzYavIrRuM)Q%tfqV2#REAJVNr$g
z3!R;+-<D3-J0yy(6<XkbX<j-r;y2TH4-+k=e+g*lKfDkgu9=|viOM9Aa6EC=h9Kc9
zT>PQTzVdoZT3JB>A})kiLyNz2f@=MCsM=`!_5gGky`M?k3sSTQYE_g}VvtX5oT(V^
zFoj`dwhbhCGH6*VXpPwaV0Ssmx|dmdJ3+LNOR?zJ=7v<sN~?lGM?cQeg$6WZ(M4lx
zT15||m5n3qUSQ>mtI@nuAesF5V8Ml`T`;d^y+VgBmZmcLU&?myGc2TSSHmcj4x9NS
z|J_lbYK@Ji<em#H7J(NNr`dAId08z{BFebDa>k1+ewIhy=p0a3?u$F>kkov6z4zVT
zs-&Kw_qEflFCNQ?zc|4+qC3Ihpl2jc<V$lv@pvZ&e0)OPp!xhUvcti12wxF=RL{?_
z*tblK6Q+40?=|ebeMv_XksJ1BR}6IhtGQ>V{yOzxs++=r4b?Gu4qr~8FjvHDX+K8i
zB}jKh+7B<fH=CM?L5nMy-D@d1CXV*1$tUV}Hv^!4cr;J06HH_Zr7kEjx%Xbs_t*`n
zRVbpv0I;h}1%{0)SwAVkuyAIOVXZ$3*}83SDyau_Ii`b}^TvRJqNjSn^e#dg7mfhx
zKs75xxQ>M_*&U#-Jm^XymY9PFe68fl_#m-}Xr9uU&?6U_1BC}jpimJm&!Mk}Fe70$
z2ww>gD%bq+{9ic`{RDhRS^z$*7dKisyas~x>9d<!>#q5VO?>po&Db=hzcXs7GhGgA
z+<;?BuhZ(zR&cf4<D=$Ib&$Wnl5sV8ql8^eApm;=SbFDeib*W9N-~IP`pvo?vrYd!
z&wAG9vh$EtOsK?rA8la9@q{w3czKw9NcmSBr#^-Va}Y!nCd?J}jyF)E35#GNW-Plc
zp*OM_?};a@WNUz?cvRh~+f<226tkoP9@D2;1b7_@-FZbWNbdWSm=19r%UiWUX{RI0
zxXV|k;7*r)HVUeZCIu7fz>wXWjo<3;QOf6hF~9{)09%BeWF=CFd#|7HSD_hn^W1N}
zS>-E-uTL!s;Lf9bHEl;E?(dhC#2r-#S7hQ1jndz5mJ~O>8ZC+WLp3;9xzyOLWJpy6
zMC?L0dbZ!9a=pfZ_xg09h{EortFolshK=0Oxl+%WWnCmBRvI5HvrKY`PYuYb`iG2)
z&}ay!UAd@6;hETXfWeqs1UF8UqYi~-Zi)~;v>w+>xRhSDLhBQD!Qeo9R^_ENnr_;D
zbsHq|gH!gU`NVW)E3zw|MNDe9^ZlMA>-|}hDfIyP+$b|IgsJ4JZC{%qWJ7u2U*eMV
zed;r1aqKsxbgMLOlBaCofxmA!l{aAb0#d@O%xwz|9=WTA)7j>H;IgDG?})MBB?|D7
zYy=A)8-d@Cx~85#R``l<aoI4qA&Q?6DrpV=ZS)>qaZN>_p&TnFoqP8DX!_|%#SIG1
zjEwWUG%oLDl+-LE{HpP*8R>d$&4R2Y9j@jz1e=*-`?Fh#*s<HEGS6-W!Js!akEq|j
t1KAZR6sDA>yw4LWmLnSe59v4<jlwZ@qk2oV|35ij@s+Avt&C~t{{U;9B;)`9

literal 0
HcmV?d00001

diff --git a/docs/events/timeline-ui-overview.asciidoc b/docs/events/timeline-ui-overview.asciidoc
index d4c46bf412..1aa844bd68 100644
--- a/docs/events/timeline-ui-overview.asciidoc
+++ b/docs/events/timeline-ui-overview.asciidoc
@@ -223,7 +223,7 @@ TIP: When querying indices that tend to be large (for example, `logs-*`), perfor
 
 NOTE: An error message displays when the query bar is empty. 
 
-- Click the help icon (image:images/esql-ref-button.png[Click the ES|QL reference button,20,20]) on the far right side of the query editor to open the in-product reference documentation for all {esql} commands and functions.  
+- Click the help icon (image:images/esql-help-ref-button.png[Click the ES|QL reference button,20,20]) on the far right side of the query editor to open the in-product reference documentation for all {esql} commands and functions.  
 - Visualize query results using {kibana-ref}/discover.html[Discover] functionality.
 
 [role="screenshot"]