From eed77167b9a43248e6a846ed8c2b8633780faaac Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Thu, 21 Nov 2024 15:15:48 -0500 Subject: [PATCH 01/13] First draft --- docs/serverless/index.asciidoc | 1 + .../rules/detection-engine-overview.asciidoc | 6 ++ .../rules/detections-logsdb-impact.asciidoc | 63 +++++++++++++++++++ 3 files changed, 70 insertions(+) create mode 100644 docs/serverless/rules/detections-logsdb-impact.asciidoc diff --git a/docs/serverless/index.asciidoc b/docs/serverless/index.asciidoc index f8612c0168..b30a0927eb 100644 --- a/docs/serverless/index.asciidoc +++ b/docs/serverless/index.asciidoc @@ -134,6 +134,7 @@ include::./dashboards/rule-monitoring-dashboard.asciidoc[leveloffset=+3] include::./rules/detection-engine-overview.asciidoc[leveloffset=+2] include::./rules/detections-permissions-section.asciidoc[leveloffset=+3] +include::./rules/detections-logsdb-impact.asciidoc[leveloffset=+3] include::./rules/about-rules.asciidoc[leveloffset=+2] include::./rules/rules-ui-create.asciidoc[leveloffset=+3] diff --git a/docs/serverless/rules/detection-engine-overview.asciidoc b/docs/serverless/rules/detection-engine-overview.asciidoc index f7a345289f..1d4e8e6872 100644 --- a/docs/serverless/rules/detection-engine-overview.asciidoc +++ b/docs/serverless/rules/detection-engine-overview.asciidoc @@ -141,3 +141,9 @@ Refer to <> for a list of all If you get this message, you do not have the <> to view the **Detections** feature, and you should contact your project administrator. + +[discrete] +[[detections-logsdb-index-mode]] +== Using logsDB index mode + +LogsDB is enabled by default for Elastic serverless. Refer to <> to learn more. \ No newline at end of file diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc new file mode 100644 index 0000000000..01b771b439 --- /dev/null +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -0,0 +1,63 @@ +[[detections-logsdb-index-mode-impact]] += The impact of usage of logsDB index mode with {sec-serverless} + +LogsDB is enabled by default for Elastic serverless. + +With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. + +During the reconstruction of the `_source`, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications compared] to the original data are possible. There could however happen to be a mismatch between how users expect field values to be formatted. + +What does it mean for you? + +[discrete] +[[logsdb-alerts]] +== Alerts + +During alert creation, the `_source` event is copied over into the alert in order to keep reference to the original data. When the logsDB index mode is applied, the `_source` event stored in the alert will be an event reconstructed using synthetic `_source`. + +If you are switching to using logsDB index mode, the `_source` field stored in the alert might look different in certain situations: + +* {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated] +* {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] + +Alerts produced by the following rule types could be affected: + +* Custom query +* Event correlation (non-sequence only) +* Non-aggregate rule types + +Alerts that are generated by threshold, {ml}, and event correlation sequence rules are not affected as they do not contain copies of the original source. + +[discrete] +[[logsdb-rule-actions]] +== Rule actions + +While we do not recommend using `_source` for actions, in case when the action relies on the `_source`, the same limitations and changes apply. + +If you send out your alerts using actions and then have logic outside of {sec-serverless} that is based on fields being in the format of the original source, their flows may be affected. In particular, affected fields would be array of objects. + +We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode. + +[discrete] +[[logsdb-runtime-fields]] +== Runtime fields + +Runtime fields on alerts index that reference `_source` may be affected. +Changes may be needed to the runtime field settings. + +Here is an example of accessing `_source` that works with logsDB index mode enabled: + +[source,console] +---- +"source": """ emit(params._source.agent.name + "_____" + doc['agent.name'].value ); """ +"source": """ emit(params._source['agent']['name'] + "_____" + doc['agent.name'].value ); """ +"source": """ emit(field('agent.name').get(null) + "_____" + doc['agent.name'].value ); """ +"source": """ emit($('agent.name', null) + "_____" + doc['agent.name'].value ); """ +---- + +The following will not work with synthetic source (logsDB index mode enabled): + +[source,console] +---- +"source": """ emit(params._source['agent.name'] + "_____" + doc['agent.name'].value ); """ +---- \ No newline at end of file From aaa65b0bdc8ef40d6515af93946c3517c158d6af Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Thu, 21 Nov 2024 15:52:53 -0500 Subject: [PATCH 02/13] Fixes ref --- docs/serverless/rules/detection-engine-overview.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detection-engine-overview.asciidoc b/docs/serverless/rules/detection-engine-overview.asciidoc index 1d4e8e6872..4ec9db3dcd 100644 --- a/docs/serverless/rules/detection-engine-overview.asciidoc +++ b/docs/serverless/rules/detection-engine-overview.asciidoc @@ -146,4 +146,4 @@ and you should contact your project administrator. [[detections-logsdb-index-mode]] == Using logsDB index mode -LogsDB is enabled by default for Elastic serverless. Refer to <> to learn more. \ No newline at end of file +LogsDB is enabled by default for Elastic serverless. Refer to <> to learn more. \ No newline at end of file From dc5c9dd24d72befb9eefa1854719e4aec56d3f9a Mon Sep 17 00:00:00 2001 From: Janeen Roberts Date: Fri, 22 Nov 2024 14:11:03 -0500 Subject: [PATCH 03/13] Some light edits for grammar and clarity. --- .../rules/detections-logsdb-impact.asciidoc | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index 01b771b439..126851e757 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -1,40 +1,40 @@ [[detections-logsdb-index-mode-impact]] -= The impact of usage of logsDB index mode with {sec-serverless} += Using logsDB index mode with {sec-serverless} -LogsDB is enabled by default for Elastic serverless. +LogsDB is enabled by default for Elastic serverless. This topic explains the impact of using logsDB index mode with {sec-serverless}. With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. -During the reconstruction of the `_source`, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications compared] to the original data are possible. There could however happen to be a mismatch between how users expect field values to be formatted. +When the `_source` is reconstructed, you can make {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] close to the original data. However, there could be a mismatch between how users expect field values to be formatted. -What does it mean for you? +Continue reading to find out how this affects specific {sec-serverless} components. [discrete] [[logsdb-alerts]] == Alerts -During alert creation, the `_source` event is copied over into the alert in order to keep reference to the original data. When the logsDB index mode is applied, the `_source` event stored in the alert will be an event reconstructed using synthetic `_source`. +When alerts are generated, the `_source` event is copied over into the alert in order to retain the original data. When the logsDB index mode is applied, the `_source` event stored in the alert is an event reconstructed using synthetic `_source`. -If you are switching to using logsDB index mode, the `_source` field stored in the alert might look different in certain situations: +If you're switching to use logsDB index mode, the `_source` field stored in the alert might look different in certain situations: * {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated] * {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] -Alerts produced by the following rule types could be affected: +Alerts generated by the following rule types could be affected: * Custom query * Event correlation (non-sequence only) * Non-aggregate rule types -Alerts that are generated by threshold, {ml}, and event correlation sequence rules are not affected as they do not contain copies of the original source. +Alerts that are generated by threshold, {ml}, and event correlation sequence rules are not affected since they do not contain copies of the original source. [discrete] [[logsdb-rule-actions]] == Rule actions -While we do not recommend using `_source` for actions, in case when the action relies on the `_source`, the same limitations and changes apply. +While we do not recommend using `_source` for actions, in cases where the action relies on the `_source`, the same limitations and changes apply. -If you send out your alerts using actions and then have logic outside of {sec-serverless} that is based on fields being in the format of the original source, their flows may be affected. In particular, affected fields would be array of objects. +If you send alert notifications by enabling {ref}/alerting-getting-started.html#alerting-concepts-actions[actions], and then have logic outside of {sec-serverless} based on fields formatted from the original source, those flows may be affected. In particular, affected fields would be an array of objects. We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode. From 4b07ffe0f7df9216013cacc86b1aec4b9fcccb71 Mon Sep 17 00:00:00 2001 From: Janeen Roberts Date: Fri, 22 Nov 2024 15:49:30 -0500 Subject: [PATCH 04/13] Fixing broken ref link --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index 126851e757..cadb0544fa 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -34,7 +34,7 @@ Alerts that are generated by threshold, {ml}, and event correlation sequence rul While we do not recommend using `_source` for actions, in cases where the action relies on the `_source`, the same limitations and changes apply. -If you send alert notifications by enabling {ref}/alerting-getting-started.html#alerting-concepts-actions[actions], and then have logic outside of {sec-serverless} based on fields formatted from the original source, those flows may be affected. In particular, affected fields would be an array of objects. +If you send alert notifications by enabling {kibana-ref}/alerting-getting-started.html#alerting-concepts-actions[actions], and then have logic outside of {sec-serverless} based on fields formatted from the original source, those flows may be affected. In particular, affected fields would be an array of objects. We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode. From 85a24ab282bcf14c98cdd09dcaead40db78f9b0b Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Tue, 26 Nov 2024 15:26:25 -0500 Subject: [PATCH 05/13] Input from Kseniia and Vitalii --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index cadb0544fa..ef4b097c45 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -19,12 +19,14 @@ If you're switching to use logsDB index mode, the `_source` field stored in the * {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated] * {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] +* `geo_point` data fields (refer to {ref}/synthetic-source-modifications-ranges[Representation of ranges] and + {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Reduced precision of `geo_point` values] for more information) Alerts generated by the following rule types could be affected: * Custom query * Event correlation (non-sequence only) -* Non-aggregate rule types +* Non-aggregate rule types (for example, {esql} rules that use non-aggregating queries) Alerts that are generated by threshold, {ml}, and event correlation sequence rules are not affected since they do not contain copies of the original source. @@ -42,10 +44,10 @@ We recommend checking and adjusting the rule actions using `_source` before swit [[logsdb-runtime-fields]] == Runtime fields -Runtime fields on alerts index that reference `_source` may be affected. +Runtime fields that reference `_source` may be affected. Changes may be needed to the runtime field settings. -Here is an example of accessing `_source` that works with logsDB index mode enabled: +The following is an example of accessing `_source` that works with logsDB index mode enabled. If an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form. Some runtime fields might not work and need to be adjusted: [source,console] ---- From e22dc7ce65c80d842ca1ce4cf8410d336a5dc3ec Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Tue, 26 Nov 2024 15:51:40 -0500 Subject: [PATCH 06/13] Fix links --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index ef4b097c45..cbdb8e2b64 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -19,8 +19,7 @@ If you're switching to use logsDB index mode, the `_source` field stored in the * {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated] * {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] -* `geo_point` data fields (refer to {ref}/synthetic-source-modifications-ranges[Representation of ranges] and - {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Reduced precision of `geo_point` values] for more information) +* `geo_point` data fields (refer to {ref}/mapping-source-field.html#synthetic-source-modifications-ranges[Representation of ranges] and {ref}/mapping-source-field.html#synthetic-source-precision-loss-for-point-types[Reduced precision of `geo_point` values] for more information) Alerts generated by the following rule types could be affected: @@ -44,10 +43,9 @@ We recommend checking and adjusting the rule actions using `_source` before swit [[logsdb-runtime-fields]] == Runtime fields -Runtime fields that reference `_source` may be affected. -Changes may be needed to the runtime field settings. +Runtime fields that reference `_source` may be affected. Some runtime fields might not work and need to be adjusted. For example, if an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form and may not work. -The following is an example of accessing `_source` that works with logsDB index mode enabled. If an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form. Some runtime fields might not work and need to be adjusted: +The following is an example of accessing `_source` that works with the logsDB index mode enabled: [source,console] ---- From eb8f5b0673885dbc0f9f372b5ca290164945c2cd Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Tue, 26 Nov 2024 16:11:51 -0500 Subject: [PATCH 07/13] Kseniia's initial feedback --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index cbdb8e2b64..5f5b4a457b 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -5,7 +5,7 @@ LogsDB is enabled by default for Elastic serverless. This topic explains the imp With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. -When the `_source` is reconstructed, you can make {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] close to the original data. However, there could be a mismatch between how users expect field values to be formatted. +When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between how users expect field values to be formatted. Continue reading to find out how this affects specific {sec-serverless} components. From d28229312dafb6f62da68049da20d899f8ef289f Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Tue, 26 Nov 2024 16:36:55 -0500 Subject: [PATCH 08/13] Update docs/serverless/rules/detections-logsdb-impact.asciidoc --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index 5f5b4a457b..091bf6edcf 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -5,7 +5,7 @@ LogsDB is enabled by default for Elastic serverless. This topic explains the imp With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. -When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between how users expect field values to be formatted. +When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between how users expectations and how fields are formatted. Continue reading to find out how this affects specific {sec-serverless} components. From ad0bc51eda7a9db79ea318647abcc14244b2d23b Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Tue, 26 Nov 2024 16:42:30 -0500 Subject: [PATCH 09/13] Removed extra word --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index 091bf6edcf..f75b13bfee 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -5,7 +5,7 @@ LogsDB is enabled by default for Elastic serverless. This topic explains the imp With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. -When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between how users expectations and how fields are formatted. +When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted. Continue reading to find out how this affects specific {sec-serverless} components. From 22be88ca502ede1875728c25bc38a7a4c742898e Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Tue, 26 Nov 2024 16:57:00 -0500 Subject: [PATCH 10/13] Update docs/serverless/rules/detections-logsdb-impact.asciidoc Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index f75b13bfee..3c9448ac54 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -13,7 +13,7 @@ Continue reading to find out how this affects specific {sec-serverless} componen [[logsdb-alerts]] == Alerts -When alerts are generated, the `_source` event is copied over into the alert in order to retain the original data. When the logsDB index mode is applied, the `_source` event stored in the alert is an event reconstructed using synthetic `_source`. +When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsDB index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. If you're switching to use logsDB index mode, the `_source` field stored in the alert might look different in certain situations: From e05d0ffe49d6b83d66a54b40fad00ee768a76ad5 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Tue, 26 Nov 2024 16:57:07 -0500 Subject: [PATCH 11/13] Update docs/serverless/rules/detections-logsdb-impact.asciidoc Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index 3c9448ac54..5e7fad3f3a 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -1,7 +1,7 @@ [[detections-logsdb-index-mode-impact]] = Using logsDB index mode with {sec-serverless} -LogsDB is enabled by default for Elastic serverless. This topic explains the impact of using logsDB index mode with {sec-serverless}. +LogsDB is enabled by default for {serverless-full}. This topic explains the impact of using logsDB index mode with {sec-serverless}. With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. From 33f823f09aa2ee672c186790385215b82fdf03d8 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Tue, 26 Nov 2024 16:57:14 -0500 Subject: [PATCH 12/13] Update docs/serverless/rules/detections-logsdb-impact.asciidoc Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index 5e7fad3f3a..7ba3cc912c 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -43,7 +43,7 @@ We recommend checking and adjusting the rule actions using `_source` before swit [[logsdb-runtime-fields]] == Runtime fields -Runtime fields that reference `_source` may be affected. Some runtime fields might not work and need to be adjusted. For example, if an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form and may not work. +Runtime fields that reference `_source` may be affected. Some runtime fields might not work and need to be adjusted. For example, if an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form and might not work. The following is an example of accessing `_source` that works with the logsDB index mode enabled: From 3f9e3f6ac28a70642513a858fd28c284ff3ef29c Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Mon, 2 Dec 2024 09:38:11 -0500 Subject: [PATCH 13/13] Update docs/serverless/rules/detections-logsdb-impact.asciidoc --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index 7ba3cc912c..f3f97a3f38 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -35,7 +35,7 @@ Alerts that are generated by threshold, {ml}, and event correlation sequence rul While we do not recommend using `_source` for actions, in cases where the action relies on the `_source`, the same limitations and changes apply. -If you send alert notifications by enabling {kibana-ref}/alerting-getting-started.html#alerting-concepts-actions[actions], and then have logic outside of {sec-serverless} based on fields formatted from the original source, those flows may be affected. In particular, affected fields would be an array of objects. +If you send alert notifications by enabling {kibana-ref}/alerting-getting-started.html#alerting-concepts-actions[actions] to the external systems that have workflows or automations based on fields formatted from the original source, they may be affected. In particular, this can happen when the fields used are arrays of objects. We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode.