diff --git a/docs/detections/detection-engine-intro.asciidoc b/docs/detections/detection-engine-intro.asciidoc index 23e5085acf..105e2ade3e 100644 --- a/docs/detections/detection-engine-intro.asciidoc +++ b/docs/detections/detection-engine-intro.asciidoc @@ -170,6 +170,6 @@ setting is not enabled in the `elasticsearch.yml` file. For more information, re [discrete] [[detections-logsdb-index-mode]] -== Using logsDB index mode +== Using logsdb index mode -To learn how your rules and alerts are affected by using the {ref}/logs-data-stream.html[LogsDB index mode], refer to <>. \ No newline at end of file +To learn how your rules and alerts are affected by using the {ref}/logs-data-stream.html[logsdb index mode], refer to <>. \ No newline at end of file diff --git a/docs/detections/detections-logsdb-impact.asciidoc b/docs/detections/detections-logsdb-impact.asciidoc index 5d8100f8fd..b33060a3dc 100644 --- a/docs/detections/detections-logsdb-impact.asciidoc +++ b/docs/detections/detections-logsdb-impact.asciidoc @@ -1,9 +1,9 @@ [[detections-logsdb-index-mode-impact]] -= Using logsDB index mode with {elastic-sec} += Using logsdb index mode with {elastic-sec} -This topic explains the impact of using logsDB index mode with {elastic-sec}. +This topic explains the impact of using logsdb index mode with {elastic-sec}. -With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. +With logsdb index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted. @@ -13,9 +13,9 @@ Continue reading to find out how this affects specific {elastic-sec} components. [[logsdb-alerts]] == Alerts -When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsDB index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. +When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsdb index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. -If you're switching to use logsDB index mode, the `_source` field stored in the alert might look different in certain situations: +If you're switching to use logsdb index mode, the `_source` field stored in the alert might look different in certain situations: * {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated] * {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] @@ -37,7 +37,7 @@ While we do not recommend using `_source` for actions, in cases where the action If you send alert notifications by enabling {kibana-ref}/alerting-getting-started.html#alerting-concepts-actions[actions] to the external systems that have workflows or automations based on fields formatted from the original source, they may be affected. In particular, this can happen when the fields used are arrays of objects. -We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode. +We recommend checking and adjusting the rule actions using `_source` before switching to logsdb index mode. [discrete] [[logsdb-runtime-fields]] @@ -45,7 +45,7 @@ We recommend checking and adjusting the rule actions using `_source` before swit Runtime fields that reference `_source` may be affected. Some runtime fields might not work and need to be adjusted. For example, if an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form and might not work. -The following is an example of accessing `_source` that works with the logsDB index mode enabled: +The following is an example of accessing `_source` that works with the logsdb index mode enabled: [source,console] ---- @@ -55,7 +55,7 @@ The following is an example of accessing `_source` that works with the logsDB in "source": """ emit($('agent.name', null) + "_____" + doc['agent.name'].value ); """ ---- -The following will not work with synthetic source (logsDB index mode enabled): +The following will not work with synthetic source (logsdb index mode enabled): [source,console] ---- diff --git a/docs/serverless/rules/detection-engine-overview.asciidoc b/docs/serverless/rules/detection-engine-overview.asciidoc index 4ec9db3dcd..605a843dc8 100644 --- a/docs/serverless/rules/detection-engine-overview.asciidoc +++ b/docs/serverless/rules/detection-engine-overview.asciidoc @@ -144,6 +144,6 @@ and you should contact your project administrator. [discrete] [[detections-logsdb-index-mode]] -== Using logsDB index mode +== Using logsdb index mode -LogsDB is enabled by default for Elastic serverless. Refer to <> to learn more. \ No newline at end of file +logsdb is enabled by default for Elastic serverless. Refer to <> to learn more. \ No newline at end of file diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index f3f97a3f38..3bec258b34 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -1,9 +1,9 @@ [[detections-logsdb-index-mode-impact]] -= Using logsDB index mode with {sec-serverless} += Using logsdb index mode with {sec-serverless} -LogsDB is enabled by default for {serverless-full}. This topic explains the impact of using logsDB index mode with {sec-serverless}. +Logsdb is enabled by default for {serverless-full}. This topic explains the impact of using logsdb index mode with {sec-serverless}. -With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. +With logsdb index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted. @@ -13,9 +13,9 @@ Continue reading to find out how this affects specific {sec-serverless} componen [[logsdb-alerts]] == Alerts -When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsDB index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. +When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsdb index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. -If you're switching to use logsDB index mode, the `_source` field stored in the alert might look different in certain situations: +If you're switching to use logsdb index mode, the `_source` field stored in the alert might look different in certain situations: * {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated] * {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] @@ -37,7 +37,7 @@ While we do not recommend using `_source` for actions, in cases where the action If you send alert notifications by enabling {kibana-ref}/alerting-getting-started.html#alerting-concepts-actions[actions] to the external systems that have workflows or automations based on fields formatted from the original source, they may be affected. In particular, this can happen when the fields used are arrays of objects. -We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode. +We recommend checking and adjusting the rule actions using `_source` before switching to logsdb index mode. [discrete] [[logsdb-runtime-fields]] @@ -45,7 +45,7 @@ We recommend checking and adjusting the rule actions using `_source` before swit Runtime fields that reference `_source` may be affected. Some runtime fields might not work and need to be adjusted. For example, if an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form and might not work. -The following is an example of accessing `_source` that works with the logsDB index mode enabled: +The following is an example of accessing `_source` that works with the logsdb index mode enabled: [source,console] ---- @@ -55,7 +55,7 @@ The following is an example of accessing `_source` that works with the logsDB in "source": """ emit($('agent.name', null) + "_____" + doc['agent.name'].value ); """ ---- -The following will not work with synthetic source (logsDB index mode enabled): +The following will not work with synthetic source (logsdb index mode enabled): [source,console] ----