Skip to content

[8.18] [8.18] Logged ES queries now provided for new terms, machine learning, custom query, threshold rule types (backport #6655) #6704

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 3, 2025
Merged

[8.18] [8.18] Logged ES queries now provided for new terms, machine learning, custom query, threshold rule types (backport #6655) #6704

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/detections/rules-ui-create.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -827,9 +827,9 @@ TIP: Avoid setting long time ranges with short rule intervals, or the rule previ
[[view-rule-es-queries]]
==== View your rule's {es} queries (optional)

NOTE: This option is only offered for {esql} and event correlation rules.
NOTE: This option is offered for all rule types except indicator match rules.

When previewing a rule, you can also learn about its {es} queries, which are submitted when the rule runs. This information can help you identify and troubleshoot potential rule issues. You can also use it to confirm that your rule is retrieving the expected data.
When previewing a rule, you can also examine the {es} queries that are submitted when the rule runs. Use this information to identify and troubleshoot potential rule issues and confirm that your rule is retrieving the expected data.

To learn more about your rule's {es} queries, preview its results and do the following:

Expand All @@ -838,6 +838,6 @@ To learn more about your rule's {es} queries, preview its results and do the fol
. Expand each row to learn more about the {es} queries that the rule submits each time it executes. The following details are provided:
** When the rule execution started, and how long it took to complete
** A brief explanation of what the {es} queries do
** The actual {es} queries that the rule submits to indices containing events that are used during the rule execution
** The first two {es} queries that the rule submits to indices containing events that are used during the rule execution
+
TIP: Run the queries in {kibana-ref}/console-kibana.html[Console] to determine if your rule is retrieving the expected data. For example, to test your rule’s exceptions, run the rule’s {es} queries, which will also contain exceptions added to the rule. If your rule’s exceptions are working as intended, the query will not return events that should be ignored.