---
title: How Kibana stores rule events
description: Kibana stores rule events in .rule-events. The episode.* lifecycle fields apply only to type alert. Triage actions go to .alert-actions.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts/rule-event-data-model
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Experimental in 9.5
---

# How Kibana stores rule events
Kibana Universal Alerting writes **rule events** to `.rule-events`. For what a rule event is and how events belong to an [alert](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts), refer to [Rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/rules/rule-event-field-reference).

## What `type` records on each event

Every time a rule finds a match, Kibana writes a rule event to `.rule-events`. The event's `type` is either `signal` or `alert`:

| `type`   | What the event represents                                                                                                                                                                       |
|----------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `signal` | Queryable in Discover for later analysis. No `episode.*` fields.                                                                                                                                |
| `alert`  | One evaluation in an [alert](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts). Events that share `episode.id` belong to the same alert. |

<note>
  Rule events with `type: signal` stay in `.rule-events`. They don't appear on **Alerts** and aren't evaluated by action policies or lifecycle triggers.
</note>


## Shared index and schema

Events with `type: signal` and events with `type: alert` share `.rule-events` and many of the same fields, including `data`, the payload from your rule's query. Filter with `WHERE type == "signal"` or `WHERE type == "alert"`.
Only `type: alert` events carry the `episode.*` fields that track lifecycle state (`episode.id`, `episode.status`, `episode.status_count`). Query those events by `episode.id` to replay an alert. Events with `type: signal` don't include `episode.*` fields.
For the full field list, including field types and which fields apply to each `type`, refer to [Field reference](/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts/field-reference#rule-events-field-schema).

## How Kibana records evaluation and triage data

Kibana writes rule output to the following append-only data streams, both managed through [index lifecycle management (ILM)](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/manage-data/lifecycle/index-lifecycle-management) and queryable with ES|QL in Discover:
- **`.rule-events`** - Kibana writes one rule event per matching row, per run, and never overwrites them. When Kibana tracks an alert, it can also write `recovered` and `no_data` events. This stream holds events with `type: signal` and events with `type: alert`.
- **`.alert-actions`** - Records every triage action taken on an alert (for example, acknowledge, snooze, and resolve). Only alerts produce documents here.


## Related pages

- [Rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/rules/rule-event-field-reference): What a rule event is and how `type` relates to rule `kind`.
- [Query rule events](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts/query-signals): Query examples for events with `type: signal`.
- [Query alert history in Discover](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8924/explore-analyze/alerting/esql/alerts/query-alerts-and-signals-in-discover): Alert lifecycle and triage queries.