---
title: Rule event data model in the experimental alerting system
description: The experimental alerting system stores rule events in .rule-events. Episode lifecycle fields apply only to type alert. Triage actions go to .alert-actions.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/alerts/rule-event-data-model
products:
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Experimental
  - Elastic Stack: Experimental since 9.5
---

# Rule event data model in the experimental alerting system
Kibana writes **rule events** to `.rule-events`. An alert episode is the grouping of those events that share an `episode.id`. This page covers where that data lives, which fields each `type` uses, and where triage actions go. For what a rule event is and how it connects to alert episodes, refer to [Rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference).

## What `type` records on each event

Every time a rule finds a match, Kibana writes a rule event to `.rule-events`. The event's `type` is either `signal` or `alert`:

| `type`   | What the event represents                                                                             |
|----------|-------------------------------------------------------------------------------------------------------|
| `signal` | Queryable in Discover for later analysis. No `episode.*` fields.                                      |
| `alert`  | One evaluation in an alert episode. The episode is the grouping of events that share an `episode.id`. |

<note>
  Action policies only evaluate alert episodes, so events with `type: signal` never reach a policy or a workflow.
</note>


## Shared index and schema

Events with `type: signal` and events that belong to an alert episode share `.rule-events` and many of the same fields, including `data`, the payload from your rule's query. Filter with `WHERE type == "signal"` or `WHERE type == "alert"`.
Only `type: alert` events carry the `episode.*` fields that track lifecycle state (`episode.id`, `episode.status`, `episode.status_count`). Query those events by `episode.id` to replay an episode. Events with `type: signal` don't include episode fields.
For the full field list, including field types and which fields apply to events with `type: signal` versus events that belong to an alert episode, refer to [Field reference](/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/alerts/field-reference#rule-events-field-schema).

## How Kibana records evaluation and triage data

Kibana writes rule output to the following append-only data streams, both managed through [index lifecycle management (ILM)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/manage-data/lifecycle/index-lifecycle-management) and queryable with ES|QL in Discover:
- **`.rule-events`** - Kibana writes one rule event per matching row, per run, and never overwrites them. When Kibana tracks an alert episode, it can also write `recovered` and `no_data` events. This stream holds events with `type: signal` and events that belong to an alert episode (`type: alert`).
- **`.alert-actions`** - Records every triage action taken on an episode (for example, acknowledge, snooze, and resolve). Only alert episodes produce documents here.


## Related pages

- [Rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/rules/rule-event-field-reference): What a rule event is and how it connects to alert episodes.
- [Query signals](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/alerts/query-signals): Query examples for events with `type: signal`.
- [Query experimental alerting system alert history in Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8062/explore-analyze/alerting/experimental-alerting-system/alerts/query-alerts-and-signals-in-discover): Episode lifecycle and triage queries.