# Elastic AI Assistant Threshold Rule Fields kibana.alert.new\_terms

**URL:** https://discuss.elastic.co/t/elastic-ai-assistant-threshold-rule-fields-kibana-alert-new-terms/360079
**Category:** Elastic Security
**Tags:** elastic-ai-assistant
**Created:** [May 23, 2024, 1:25pm UTC](https://discuss.elastic.co/t/elastic-ai-assistant-threshold-rule-fields-kibana-alert-new-terms/360079 "2024-05-23T13:25:28Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [May 23, 2024, 1:25pm UTC](https://discuss.elastic.co/t/elastic-ai-assistant-threshold-rule-fields-kibana-alert-new-terms/360079/1 "2024-05-23T13:25:28Z")

</div>

Hello,

Question about adding alerts for threshold rules.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4b192bdd4bf88db4fdb48ebd49e3aede6efba307.png)

Am I correct assuming that the field `kibana.alert.new_terms` and it's value cannot be added to the alert data sent as context?

Is there some way to always add this field when available?

Willem

---

<div class="post-metadata">

### Author: ![Yuliia\_Naumenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuliia_naumenko/32/100923_2.png) [@Yuliia\_Naumenko](https://discuss.elastic.co/u/Yuliia_Naumenko)
#### Post date: [June 4, 2024, 7:54pm UTC](https://discuss.elastic.co/t/elastic-ai-assistant-threshold-rule-fields-kibana-alert-new-terms/360079/2 "2024-06-04T19:54:13Z")

</div>

In 8.13 this field is possible to add per alert document in the Assistant dialog opened within Alert flyout. Alert document will be added as a message context with the list of all the fields, which have a value. In that similar anonymization table you can manage what is send/anonymized, but for the particular document (but only if the field has value).

> Is there some way to always add this field when available?

In 8.14 is added support for a centralized anonymization, where you can persist this as a setting.

---

<div class="post-metadata">

### Author: ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [June 4, 2024, 8:10pm UTC](https://discuss.elastic.co/t/elastic-ai-assistant-threshold-rule-fields-kibana-alert-new-terms/360079/3 "2024-06-04T20:10:41Z")

</div>

Hello @Yuliia_Naumenko

Thanks for your answer.

Unfortunately we are on 8.13 and I cannot find the field in the threshold alert in the assistant.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4eb0db0e99b2ea1bfcd353bc46656f8a7fe96328.png)

This is a very important field used in a lot of rules. Can it please be added by Elastic by default?

Tx

---

<div class="post-metadata">

### Author: ![Yuliia\_Naumenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuliia_naumenko/32/100923_2.png) [@Yuliia\_Naumenko](https://discuss.elastic.co/u/Yuliia_Naumenko)
#### Post date: [June 4, 2024, 8:45pm UTC](https://discuss.elastic.co/t/elastic-ai-assistant-threshold-rule-fields-kibana-alert-new-terms/360079/4 "2024-06-04T20:45:01Z")

</div>

Is the field `kibana.alert.new_term` filled with the value on the Table/JSON view of the Alert flyout?

> This is a very important field used in a lot of rules. Can it please be added by Elastic by default?

We will definitely consider this request.

> Blockquote

---

<div class="post-metadata">

### Author: ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [June 6, 2024, 5:54pm UTC](https://discuss.elastic.co/t/elastic-ai-assistant-threshold-rule-fields-kibana-alert-new-terms/360079/5 "2024-06-06T17:54:04Z")

</div>

Hello Yuliia,

APparently I mixed up `kibana.alert.new_terms` and `kibana.alert.threshold_result.terms.value`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/9/69263c6d45696135d55a8d77446bc0412c7d4aad.png)

I do find it when looking for the correct field... 😅 Thanks for the help!

`This is a very important field used in a lot of rules. Can it please be added by Elastic by default?`

I do find `kibana.alert.threshold_result.terms.value`, but it would be nice if that was also added by default imho.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/2/324819303c1ae20b9b93edee6d9977a7d5f6811c.png)

Willem

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 4, 2024, 5:54pm UTC](https://discuss.elastic.co/t/elastic-ai-assistant-threshold-rule-fields-kibana-alert-new-terms/360079/6 "2024-07-04T17:54:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
