# Get base events triggered by a threshold rule

**URL:** https://discuss.elastic.co/t/get-base-events-triggered-by-a-threshold-rule/343034
**Category:** Elastic Security
**Created:** [September 14, 2023, 9:35am UTC](https://discuss.elastic.co/t/get-base-events-triggered-by-a-threshold-rule/343034 "2023-09-14T09:35:09Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![c8n](https://avatars.discourse-cdn.com/v4/letter/c/e0b2c6/32.png) [@c8n](https://discuss.elastic.co/u/c8n)
#### Post date: [September 14, 2023, 9:35am UTC](https://discuss.elastic.co/t/get-base-events-triggered-by-a-threshold-rule/343034/1 "2023-09-14T09:35:09Z")

</div>

I'm having a hard time trying to get the base events that triggered a threshold rule using a logstash pipeline. Right now I've built a KQL query that gives those documents, but still doesnt populate any field in the original event.

Code looks like:

```auto
input {
   elasticsearch {
        ...data connection details to some elastic_instance_A
   }
}

filter {

   mutate {
      add_field => { "field_i_need_to_fill" => "placeholder_data" }
   }

   elasticsearch {
      tag_on_failure => '_noctlquerythreshold_exception'               
      index => "%{kibana.alert.rule.indices}"
      query => "%{kql_query_that_gives_the_data} "
      fields => { 
        "_id" => "field_i_need_to_fill"
      }
  }
 
}

```

Edit1. Already tried using `doc_field` and `aggregation_field` options of elasticsearch filter. Still no results.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 12, 2023, 9:35am UTC](https://discuss.elastic.co/t/get-base-events-triggered-by-a-threshold-rule/343034/2 "2023-10-12T09:35:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.