Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DOCS] Fallback to @timestamp is configurable when timestamp override is defined #2246

Closed
jmikell821 opened this issue Aug 3, 2022 · 1 comment

Comments

@jmikell821
Copy link
Contributor

Issue: elastic/kibana#112315
PR: elastic/kibana#135116

Description

Currently, when a timestamp override field is defined for detection engine rules, @timestamp is always added automatically as a fallback timestamp field. This is useful in cases where multiple data sources are being queried by the same rule, but not all data sources populate the timestamp override field. However, in other cases @timestamp may be completely unreliable and we would like to avoid querying it at all. We should make the @timestamp fallback behavior more configurable, perhaps allowing multiple timestamp overrides to be defined or creating a flag that disables the fallback.

These changes allow user to configure @timestamp fallback when timestamp override is defined. There is a new checkbox which allows to disable fallback to @timestamp when Timestamp Override is defined.
image

@jmikell821
Copy link
Contributor Author

Closing as this is a duplicate of #2196.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant