---
title: Alert data model in the experimental alerting system
description: Alert history in Kibana's experimental alerting system lives in two append-only streams, .rule-events for evaluations and .alert-actions for triage. Signals and alerts differ by rule mode.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/6527/explore-analyze/alerting/kibana-alerting-experimental/alerts/alert-data-model
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Planned
---

# Alert data model in the experimental alerting system
This page explains the foundational data model of the experimental alerting system. It explains what the system writes, where it writes it, and why those choices affect what you can do with the data.

## How rule mode determines what gets written

Every time a rule finds a match, it writes a document to `.rule-events`. Whether that document is a signal or an alert depends on the rule's mode.

| Type   | What it is                                                             | When it's created    |
|--------|------------------------------------------------------------------------|----------------------|
| Signal | A point-in-time record that the query matched (`type: signal`).        | Rules in Signal mode |
| Alert  | A lifecycle-tracked episode with `type: alert` and `episode.*` fields. | Rules in Alert mode  |

<note>
  A rule in Signal mode only writes signals. It never opens alert episodes, so action policies have nothing to match against.
</note>


## How Kibana records evaluation and triage data

Rule output is written to the following append-only data streams, both managed by Kibana through ILM and queryable with ES|QL in Discover:
- **`.rule-events`** - Kibana writes one document for each rule evaluation and never overwrites them.
- **`.alert-actions`** - Records every triage action taken on an episode (for example, acknowledge, snooze, and resolve).