From d28229312dafb6f62da68049da20d899f8ef289f Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Tue, 26 Nov 2024 16:36:55 -0500 Subject: [PATCH] Update docs/serverless/rules/detections-logsdb-impact.asciidoc --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index 5f5b4a457b..091bf6edcf 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -5,7 +5,7 @@ LogsDB is enabled by default for Elastic serverless. This topic explains the imp With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. -When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between how users expect field values to be formatted. +When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between how users expectations and how fields are formatted. Continue reading to find out how this affects specific {sec-serverless} components.