diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index 5f5b4a457b..091bf6edcf 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -5,7 +5,7 @@ LogsDB is enabled by default for Elastic serverless. This topic explains the imp With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. -When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between how users expect field values to be formatted. +When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between how users expectations and how fields are formatted. Continue reading to find out how this affects specific {sec-serverless} components.