# Include a custom non-ECS field in alerts **URL:** \ **Category:** Elastic Security\ **Tags:** detection-rules\ **Created:** [January 17, 2024, 1:30pm UTC](https://discuss.elastic.co/t/include-a-custom-non-ecs-field-in-alerts/351280 "2024-01-17T13:30:13Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jcruz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jcruz/32/91772_2.png) [@jcruz](https://discuss.elastic.co/u/jcruz)\ **Post date:** [January 17, 2024, 1:30pm UTC](https://discuss.elastic.co/t/include-a-custom-non-ecs-field-in-alerts/351280/1 "2024-01-17T13:30:13Z")
Hello guys! We have some indices with enriched custom fields that are not ECS compatible, as they are business related information. We would like to have those fields in the alerts generated from Detection-Rules, so we can aggregate those alerts based on those business information. It there any way to include those fields in the alerts events? I have looked for a way to implement it and I didn't find any solution, just some information that ECS fields are included automatically. Thanks in advance! Roberto! ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [January 17, 2024, 2:08pm UTC](https://discuss.elastic.co/t/include-a-custom-non-ecs-field-in-alerts/351280/2 "2024-01-17T14:08:15Z")
How are you creating the rules? I have multiple rules that use non ECS fields without any issue. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 14, 2024, 2:08pm UTC](https://discuss.elastic.co/t/include-a-custom-non-ecs-field-in-alerts/351280/3 "2024-02-14T14:08:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.