Query alert indicesedit
This page explains how you should query alert indices, for example, when building rule queries, custom dashboards, or visualizations. For more information about alert event field definitions, review the Alert schema.
Alert index aliasesedit
We recommend querying the following index aliases:
-
If you’re using version 8.0.0 or later:
.alerts-security.alerts-<space-id>This alias includes the legacy (before 8.0.0) and the new alert indices. -
If you’re using a version before 8.0.0:
.siem-signals-<space-id>Queries on this alias will function regardless of your Elastic Stack version but will not follow the newer.alertsnaming convention and may be deprecated in future releases.
Regardless of which alias you query, you should not include a dash or wildcard after the space ID. To query all spaces, use the following syntax: .alerts-security.alerts-* or .siem-signals-*.
Alert indicesedit
For additional context, alert events are stored in hidden Elasticsearch indices. We do not recommend querying them directly. The naming conventions for these indices and their aliases differ depending on which version of Elastic Stack you’re running:
-
8.0.0 or later:
.internal.alerts-security.alerts-<space-id>-NNNNNN, whereNNNNNNis a number that increases over time, starting from 000001. -
Before 8.0.0:
.siem-signals-<space-id>-NNNNNN, whereNNNNNNis a number that increases over time, starting from 000001.