From 408eb76c6d4b46ea1a2d614121641b86845d3037 Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Wed, 4 Dec 2024 11:45:26 -0500 Subject: [PATCH 01/10] First draft --- .../detection-engine-intro.asciidoc | 6 ++ docs/detections/detections-index.asciidoc | 2 + .../detections-logsdb-impact.asciidoc | 63 +++++++++++++++++++ 3 files changed, 71 insertions(+) create mode 100644 docs/detections/detections-logsdb-impact.asciidoc diff --git a/docs/detections/detection-engine-intro.asciidoc b/docs/detections/detection-engine-intro.asciidoc index b522d3f4bd..04984e3525 100644 --- a/docs/detections/detection-engine-intro.asciidoc +++ b/docs/detections/detection-engine-intro.asciidoc @@ -167,3 +167,9 @@ and you should contact your {kib} administrator. NOTE: For *self-managed* {stack} deployments only, this message may be displayed when the <> setting is not enabled in the `elasticsearch.yml` file. For more information, refer to <>. + +[discrete] +[[detections-logsdb-index-mode]] +== Using logsDB index mode + +LogsDB is enabled by default for Elastic serverless. Refer to <> to learn more. \ No newline at end of file diff --git a/docs/detections/detections-index.asciidoc b/docs/detections/detections-index.asciidoc index 2d1cab74d6..ff45aa827b 100644 --- a/docs/detections/detections-index.asciidoc +++ b/docs/detections/detections-index.asciidoc @@ -2,6 +2,8 @@ include::detection-engine-intro.asciidoc[] include::detections-req.asciidoc[leveloffset=+1] +include::detections-logsdb-impact.asciidoc[leveloffset=+1] + include::about-rules.asciidoc[] diff --git a/docs/detections/detections-logsdb-impact.asciidoc b/docs/detections/detections-logsdb-impact.asciidoc new file mode 100644 index 0000000000..f3f97a3f38 --- /dev/null +++ b/docs/detections/detections-logsdb-impact.asciidoc @@ -0,0 +1,63 @@ +[[detections-logsdb-index-mode-impact]] += Using logsDB index mode with {sec-serverless} + +LogsDB is enabled by default for {serverless-full}. This topic explains the impact of using logsDB index mode with {sec-serverless}. + +With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. + +When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted. + +Continue reading to find out how this affects specific {sec-serverless} components. + +[discrete] +[[logsdb-alerts]] +== Alerts + +When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsDB index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. + +If you're switching to use logsDB index mode, the `_source` field stored in the alert might look different in certain situations: + +* {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated] +* {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] +* `geo_point` data fields (refer to {ref}/mapping-source-field.html#synthetic-source-modifications-ranges[Representation of ranges] and {ref}/mapping-source-field.html#synthetic-source-precision-loss-for-point-types[Reduced precision of `geo_point` values] for more information) + +Alerts generated by the following rule types could be affected: + +* Custom query +* Event correlation (non-sequence only) +* Non-aggregate rule types (for example, {esql} rules that use non-aggregating queries) + +Alerts that are generated by threshold, {ml}, and event correlation sequence rules are not affected since they do not contain copies of the original source. + +[discrete] +[[logsdb-rule-actions]] +== Rule actions + +While we do not recommend using `_source` for actions, in cases where the action relies on the `_source`, the same limitations and changes apply. + +If you send alert notifications by enabling {kibana-ref}/alerting-getting-started.html#alerting-concepts-actions[actions] to the external systems that have workflows or automations based on fields formatted from the original source, they may be affected. In particular, this can happen when the fields used are arrays of objects. + +We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode. + +[discrete] +[[logsdb-runtime-fields]] +== Runtime fields + +Runtime fields that reference `_source` may be affected. Some runtime fields might not work and need to be adjusted. For example, if an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form and might not work. + +The following is an example of accessing `_source` that works with the logsDB index mode enabled: + +[source,console] +---- +"source": """ emit(params._source.agent.name + "_____" + doc['agent.name'].value ); """ +"source": """ emit(params._source['agent']['name'] + "_____" + doc['agent.name'].value ); """ +"source": """ emit(field('agent.name').get(null) + "_____" + doc['agent.name'].value ); """ +"source": """ emit($('agent.name', null) + "_____" + doc['agent.name'].value ); """ +---- + +The following will not work with synthetic source (logsDB index mode enabled): + +[source,console] +---- +"source": """ emit(params._source['agent.name'] + "_____" + doc['agent.name'].value ); """ +---- \ No newline at end of file From bede8ccc3bc3f90c4a938827217f65136e88c6f7 Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Wed, 4 Dec 2024 11:49:11 -0500 Subject: [PATCH 02/10] Removes serverless content --- docs/detections/detection-engine-intro.asciidoc | 2 +- docs/detections/detections-logsdb-impact.asciidoc | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/detections/detection-engine-intro.asciidoc b/docs/detections/detection-engine-intro.asciidoc index 04984e3525..1ac75fa7d1 100644 --- a/docs/detections/detection-engine-intro.asciidoc +++ b/docs/detections/detection-engine-intro.asciidoc @@ -172,4 +172,4 @@ setting is not enabled in the `elasticsearch.yml` file. For more information, re [[detections-logsdb-index-mode]] == Using logsDB index mode -LogsDB is enabled by default for Elastic serverless. Refer to <> to learn more. \ No newline at end of file +You must select the LogsDB index mode. Refer to <> to learn more. \ No newline at end of file diff --git a/docs/detections/detections-logsdb-impact.asciidoc b/docs/detections/detections-logsdb-impact.asciidoc index f3f97a3f38..5d8100f8fd 100644 --- a/docs/detections/detections-logsdb-impact.asciidoc +++ b/docs/detections/detections-logsdb-impact.asciidoc @@ -1,13 +1,13 @@ [[detections-logsdb-index-mode-impact]] -= Using logsDB index mode with {sec-serverless} += Using logsDB index mode with {elastic-sec} -LogsDB is enabled by default for {serverless-full}. This topic explains the impact of using logsDB index mode with {sec-serverless}. +This topic explains the impact of using logsDB index mode with {elastic-sec}. With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted. -Continue reading to find out how this affects specific {sec-serverless} components. +Continue reading to find out how this affects specific {elastic-sec} components. [discrete] [[logsdb-alerts]] From 90c24fc08dff9cbe2f09cb0c879013e1c6a53404 Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Wed, 4 Dec 2024 15:49:56 -0500 Subject: [PATCH 03/10] Minor change --- docs/detections/detection-engine-intro.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/detections/detection-engine-intro.asciidoc b/docs/detections/detection-engine-intro.asciidoc index 1ac75fa7d1..61c5833366 100644 --- a/docs/detections/detection-engine-intro.asciidoc +++ b/docs/detections/detection-engine-intro.asciidoc @@ -172,4 +172,4 @@ setting is not enabled in the `elasticsearch.yml` file. For more information, re [[detections-logsdb-index-mode]] == Using logsDB index mode -You must select the LogsDB index mode. Refer to <> to learn more. \ No newline at end of file +To learn more about how your rules and alerts are affected by using the {ref}/logs-data-stream.html[LogsDB index mode], refer to <>. \ No newline at end of file From ff21b357774df6482bcf4b080b62a4d76f259855 Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Wed, 4 Dec 2024 15:52:44 -0500 Subject: [PATCH 04/10] Removes unnecessary words --- docs/detections/detection-engine-intro.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/detections/detection-engine-intro.asciidoc b/docs/detections/detection-engine-intro.asciidoc index 61c5833366..23e5085acf 100644 --- a/docs/detections/detection-engine-intro.asciidoc +++ b/docs/detections/detection-engine-intro.asciidoc @@ -172,4 +172,4 @@ setting is not enabled in the `elasticsearch.yml` file. For more information, re [[detections-logsdb-index-mode]] == Using logsDB index mode -To learn more about how your rules and alerts are affected by using the {ref}/logs-data-stream.html[LogsDB index mode], refer to <>. \ No newline at end of file +To learn how your rules and alerts are affected by using the {ref}/logs-data-stream.html[LogsDB index mode], refer to <>. \ No newline at end of file From e8520f53428ea5bd8d94320cd1214c1c1b890457 Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Tue, 10 Dec 2024 14:11:28 -0500 Subject: [PATCH 05/10] Fixes casing for all mentions of logsdb ESS and Serverless --- docs/detections/detection-engine-intro.asciidoc | 4 ++-- .../detections/detections-logsdb-impact.asciidoc | 16 ++++++++-------- .../rules/detection-engine-overview.asciidoc | 4 ++-- .../rules/detections-logsdb-impact.asciidoc | 16 ++++++++-------- 4 files changed, 20 insertions(+), 20 deletions(-) diff --git a/docs/detections/detection-engine-intro.asciidoc b/docs/detections/detection-engine-intro.asciidoc index 23e5085acf..105e2ade3e 100644 --- a/docs/detections/detection-engine-intro.asciidoc +++ b/docs/detections/detection-engine-intro.asciidoc @@ -170,6 +170,6 @@ setting is not enabled in the `elasticsearch.yml` file. For more information, re [discrete] [[detections-logsdb-index-mode]] -== Using logsDB index mode +== Using logsdb index mode -To learn how your rules and alerts are affected by using the {ref}/logs-data-stream.html[LogsDB index mode], refer to <>. \ No newline at end of file +To learn how your rules and alerts are affected by using the {ref}/logs-data-stream.html[logsdb index mode], refer to <>. \ No newline at end of file diff --git a/docs/detections/detections-logsdb-impact.asciidoc b/docs/detections/detections-logsdb-impact.asciidoc index 5d8100f8fd..b33060a3dc 100644 --- a/docs/detections/detections-logsdb-impact.asciidoc +++ b/docs/detections/detections-logsdb-impact.asciidoc @@ -1,9 +1,9 @@ [[detections-logsdb-index-mode-impact]] -= Using logsDB index mode with {elastic-sec} += Using logsdb index mode with {elastic-sec} -This topic explains the impact of using logsDB index mode with {elastic-sec}. +This topic explains the impact of using logsdb index mode with {elastic-sec}. -With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. +With logsdb index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted. @@ -13,9 +13,9 @@ Continue reading to find out how this affects specific {elastic-sec} components. [[logsdb-alerts]] == Alerts -When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsDB index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. +When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsdb index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. -If you're switching to use logsDB index mode, the `_source` field stored in the alert might look different in certain situations: +If you're switching to use logsdb index mode, the `_source` field stored in the alert might look different in certain situations: * {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated] * {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] @@ -37,7 +37,7 @@ While we do not recommend using `_source` for actions, in cases where the action If you send alert notifications by enabling {kibana-ref}/alerting-getting-started.html#alerting-concepts-actions[actions] to the external systems that have workflows or automations based on fields formatted from the original source, they may be affected. In particular, this can happen when the fields used are arrays of objects. -We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode. +We recommend checking and adjusting the rule actions using `_source` before switching to logsdb index mode. [discrete] [[logsdb-runtime-fields]] @@ -45,7 +45,7 @@ We recommend checking and adjusting the rule actions using `_source` before swit Runtime fields that reference `_source` may be affected. Some runtime fields might not work and need to be adjusted. For example, if an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form and might not work. -The following is an example of accessing `_source` that works with the logsDB index mode enabled: +The following is an example of accessing `_source` that works with the logsdb index mode enabled: [source,console] ---- @@ -55,7 +55,7 @@ The following is an example of accessing `_source` that works with the logsDB in "source": """ emit($('agent.name', null) + "_____" + doc['agent.name'].value ); """ ---- -The following will not work with synthetic source (logsDB index mode enabled): +The following will not work with synthetic source (logsdb index mode enabled): [source,console] ---- diff --git a/docs/serverless/rules/detection-engine-overview.asciidoc b/docs/serverless/rules/detection-engine-overview.asciidoc index 4ec9db3dcd..605a843dc8 100644 --- a/docs/serverless/rules/detection-engine-overview.asciidoc +++ b/docs/serverless/rules/detection-engine-overview.asciidoc @@ -144,6 +144,6 @@ and you should contact your project administrator. [discrete] [[detections-logsdb-index-mode]] -== Using logsDB index mode +== Using logsdb index mode -LogsDB is enabled by default for Elastic serverless. Refer to <> to learn more. \ No newline at end of file +logsdb is enabled by default for Elastic serverless. Refer to <> to learn more. \ No newline at end of file diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index f3f97a3f38..3bec258b34 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -1,9 +1,9 @@ [[detections-logsdb-index-mode-impact]] -= Using logsDB index mode with {sec-serverless} += Using logsdb index mode with {sec-serverless} -LogsDB is enabled by default for {serverless-full}. This topic explains the impact of using logsDB index mode with {sec-serverless}. +Logsdb is enabled by default for {serverless-full}. This topic explains the impact of using logsdb index mode with {sec-serverless}. -With logsDB index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. +With logsdb index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted. @@ -13,9 +13,9 @@ Continue reading to find out how this affects specific {sec-serverless} componen [[logsdb-alerts]] == Alerts -When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsDB index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. +When alerts are generated, the `_source` event is copied into the alert to retain the original data. When the logsdb index mode is applied, the `_source` event stored in the alert is reconstructed using synthetic `_source`. -If you're switching to use logsDB index mode, the `_source` field stored in the alert might look different in certain situations: +If you're switching to use logsdb index mode, the `_source` field stored in the alert might look different in certain situations: * {ref}/mapping-source-field.html#synthetic-source-modifications-leaf-arrays[Arrays can be reconstructed differently or deduplicated] * {ref}/mapping-source-field.html#synthetic-source-modifications-field-names[Field names] @@ -37,7 +37,7 @@ While we do not recommend using `_source` for actions, in cases where the action If you send alert notifications by enabling {kibana-ref}/alerting-getting-started.html#alerting-concepts-actions[actions] to the external systems that have workflows or automations based on fields formatted from the original source, they may be affected. In particular, this can happen when the fields used are arrays of objects. -We recommend checking and adjusting the rule actions using `_source` before switching to logsDB index mode. +We recommend checking and adjusting the rule actions using `_source` before switching to logsdb index mode. [discrete] [[logsdb-runtime-fields]] @@ -45,7 +45,7 @@ We recommend checking and adjusting the rule actions using `_source` before swit Runtime fields that reference `_source` may be affected. Some runtime fields might not work and need to be adjusted. For example, if an event was indexed with the value of `agent.name` in the dot-notation form, it will be returned in the nested form and might not work. -The following is an example of accessing `_source` that works with the logsDB index mode enabled: +The following is an example of accessing `_source` that works with the logsdb index mode enabled: [source,console] ---- @@ -55,7 +55,7 @@ The following is an example of accessing `_source` that works with the logsDB in "source": """ emit($('agent.name', null) + "_____" + doc['agent.name'].value ); """ ---- -The following will not work with synthetic source (logsDB index mode enabled): +The following will not work with synthetic source (logsdb index mode enabled): [source,console] ---- From a3a8e8fcfac4ab928f3f2da44a3ad83f9e3e3d7a Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Thu, 12 Dec 2024 11:16:37 -0500 Subject: [PATCH 06/10] Update docs/detections/detections-logsdb-impact.asciidoc Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> --- docs/detections/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/detections/detections-logsdb-impact.asciidoc b/docs/detections/detections-logsdb-impact.asciidoc index b33060a3dc..00f1d152c5 100644 --- a/docs/detections/detections-logsdb-impact.asciidoc +++ b/docs/detections/detections-logsdb-impact.asciidoc @@ -1,7 +1,7 @@ [[detections-logsdb-index-mode-impact]] = Using logsdb index mode with {elastic-sec} -This topic explains the impact of using logsdb index mode with {elastic-sec}. +This topic explains the impact of using logsdb index mode with {elastic-sec}. With logsdb index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. From d747627bc5862734bf779aa4023d73c7a98dc49d Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Thu, 12 Dec 2024 11:17:22 -0500 Subject: [PATCH 07/10] Update docs/detections/detections-logsdb-impact.asciidoc Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> --- docs/detections/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/detections/detections-logsdb-impact.asciidoc b/docs/detections/detections-logsdb-impact.asciidoc index 00f1d152c5..9c205adee0 100644 --- a/docs/detections/detections-logsdb-impact.asciidoc +++ b/docs/detections/detections-logsdb-impact.asciidoc @@ -5,7 +5,7 @@ This topic explains the impact of using logsdb index mode with {elastic-sec}. With logsdb index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. -When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted. +When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between users' expectations and how fields are formatted. Continue reading to find out how this affects specific {elastic-sec} components. From 57cd461852f7e6f8c13add0489c627eb24767c86 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Thu, 12 Dec 2024 11:17:29 -0500 Subject: [PATCH 08/10] Update docs/serverless/rules/detections-logsdb-impact.asciidoc Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index 3bec258b34..a3451485af 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -5,7 +5,7 @@ Logsdb is enabled by default for {serverless-full}. This topic explains the impa With logsdb index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. -When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between user's expectations and how fields are formatted. +When the `_source` is reconstructed, {ref}/mapping-source-field.html#synthetic-source-modifications[modifications] are possible. Therefore, there could be a mismatch between users' expectations and how fields are formatted. Continue reading to find out how this affects specific {sec-serverless} components. From 27ff931a586feef6104af7f388954210c57a43b4 Mon Sep 17 00:00:00 2001 From: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> Date: Thu, 12 Dec 2024 11:17:37 -0500 Subject: [PATCH 09/10] Update docs/serverless/rules/detections-logsdb-impact.asciidoc Co-authored-by: natasha-moore-elastic <137783811+natasha-moore-elastic@users.noreply.github.com> --- docs/serverless/rules/detections-logsdb-impact.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/serverless/rules/detections-logsdb-impact.asciidoc b/docs/serverless/rules/detections-logsdb-impact.asciidoc index a3451485af..dbbceda14c 100644 --- a/docs/serverless/rules/detections-logsdb-impact.asciidoc +++ b/docs/serverless/rules/detections-logsdb-impact.asciidoc @@ -1,7 +1,7 @@ [[detections-logsdb-index-mode-impact]] = Using logsdb index mode with {sec-serverless} -Logsdb is enabled by default for {serverless-full}. This topic explains the impact of using logsdb index mode with {sec-serverless}. +Logsdb is enabled by default for {serverless-full}. This topic explains the impact of using logsdb index mode with {sec-serverless}. With logsdb index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`]. From 82eded012eca9505d5eefa4094f51514fff33c07 Mon Sep 17 00:00:00 2001 From: "nastasha.solomon" Date: Thu, 12 Dec 2024 11:25:04 -0500 Subject: [PATCH 10/10] Adds licensing info --- docs/detections/detections-logsdb-impact.asciidoc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/detections/detections-logsdb-impact.asciidoc b/docs/detections/detections-logsdb-impact.asciidoc index 9c205adee0..1b304c7f1e 100644 --- a/docs/detections/detections-logsdb-impact.asciidoc +++ b/docs/detections/detections-logsdb-impact.asciidoc @@ -1,7 +1,9 @@ [[detections-logsdb-index-mode-impact]] = Using logsdb index mode with {elastic-sec} -This topic explains the impact of using logsdb index mode with {elastic-sec}. +NOTE: To use the {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`] feature, you must have the appropriate subscription. Refer to the subscription page for https://www.elastic.co/subscriptions/cloud[Elastic Cloud] and {subscriptions}[Elastic Stack/self-managed] for the breakdown of available features and their associated subscription tiers. + +This topic explains the impact of using logsdb index mode with {elastic-sec}. With logsdb index mode, the original `_source` field is not stored in the index but can be reconstructed using {ref}/mapping-source-field.html#synthetic-source[synthetic `_source`].