---
title: How Kibana stores rule events in the experimental alerting system
description: The experimental alerting system stores rule events in .rule-events. The episode.* lifecycle fields apply only to type alert. Triage actions go to .alert-actions.
url: https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts/rule-event-data-model
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Experimental since 9.5
---

# How Kibana stores rule events in the experimental alerting system
Kibana writes **rule events** to `.rule-events`. This page covers where that data lives, which fields each `type` uses, and where triage actions go. For what a rule event is, refer to [Rule events](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference). For how events with `type: alert` relate to an [alert episode](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts), refer to [Alerts](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts).

## What `type` records on each event

Every time a rule finds a match, Kibana writes a rule event to `.rule-events`. The event's `type` is either `signal` or `alert`:

| `type`   | What the event represents                                                                                                                                                                                                  |
|----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `signal` | Queryable in Discover for later analysis. No `episode.*` fields.                                                                                                                                                           |
| `alert`  | One evaluation in an [alert episode](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts). Events that share `episode.id` belong to the same alert episode. |

<note>
  Rule events with `type: signal` stay in `.rule-events`. They don't appear on **Alerts** and aren't evaluated by action policies or lifecycle triggers.
</note>


## Shared index and schema

Events with `type: signal` and events with `type: alert` share `.rule-events` and many of the same fields, including `data`, the payload from your rule's query. Filter with `WHERE type == "signal"` or `WHERE type == "alert"`.
Only `type: alert` events carry the `episode.*` fields that track lifecycle state (`episode.id`, `episode.status`, `episode.status_count`). Query those events by `episode.id` to replay an alert episode. Events with `type: signal` don't include `episode.*` fields.
For the full field list, including field types and which fields apply to each `type`, refer to [Field reference](/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts/field-reference#rule-events-field-schema).

## How Kibana records evaluation and triage data

Kibana writes rule output to the following append-only data streams, both managed through [index lifecycle management (ILM)](https://www.elastic.co/elastic/docs-builder/docs/4116/manage-data/lifecycle/index-lifecycle-management) and queryable with ES|QL in Discover:
- **`.rule-events`** - Kibana writes one rule event per matching row, per run, and never overwrites them. When Kibana tracks an alert episode, it can also write `recovered` and `no_data` events. This stream holds events with `type: signal` and events with `type: alert`.
- **`.alert-actions`** - Records every triage action taken on an alert episode (for example, acknowledge, snooze, and resolve). Only alert episodes produce documents here.


## Related pages

- [Rule events](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference): What a rule event is and how `type` relates to rule `kind`.
- [Query rule events](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts/query-signals): Query examples for events with `type: signal`.
- [Query experimental alerting system alert history in Discover](https://www.elastic.co/elastic/docs-builder/docs/4116/explore-analyze/alerting/experimental-alerting-system/alerts/query-alerts-and-signals-in-discover): Alert episode lifecycle and triage queries.