Alert data model in the experimental alerting system
This page explains the foundational data model of the experimental alerting system. It explains what the system writes, where it writes it, and why those choices affect what you can do with the data.
Every time a rule finds a match, it writes a document to .rule-events. Whether that document is a signal or an alert depends on the rule's mode.
| Type | What it is | When it's created |
|---|---|---|
| Signal | A point-in-time record that the query matched (type: signal). |
Rules in Signal mode |
| Alert | A lifecycle-tracked episode with type: alert and episode.* fields. |
Rules in Alert mode |
Note
A rule in Signal mode only writes signals. It never opens alert episodes, so action policies have nothing to match against.
Rule output is written to the following append-only data streams, both managed by Kibana through ILM and queryable with ES|QL in Discover:
.rule-events- Kibana writes one document for each rule evaluation and never overwrites them..alert-actions- Records every triage action taken on an episode (for example, acknowledge, snooze, and resolve).