# Inquiries about warning fields

**URL:** <https://discuss.elastic.co/t/inquiries-about-warning-fields/303695>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [May 2, 2022, 1:43am UTC](https://discuss.elastic.co/t/inquiries-about-warning-fields/303695 "2022-05-02T01:43:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![inwoo1](https://avatars.discourse-cdn.com/v4/letter/i/ed655f/32.png) [@inwoo1](https://discuss.elastic.co/u/inwoo1)\
**Post date:** [May 2, 2022, 1:43am UTC](https://discuss.elastic.co/t/inquiries-about-warning-fields/303695/1 "2022-05-02T01:43:55Z")

</div>

![이미지1](https://us1.discourse-cdn.com/elastic/original/3X/3/3/3349ab6cf6346b45da1e133de8ed191f8d37fc87.png)

As you can see, I am going to set up an Alert, and I  
The field name you set is not visible.  
Fields starting with iso. are not visible, and fields starting with the changed forti\_ are not visible.  
How can I make this field name selectable in Alert settings?

```auto
  mutate { 
    rename => { 
        "iso.org.dod.internet.private.enterprises.12356.101.4.1.22.0" => "forti_fw_uptime" 
        "iso.org.dod.internet.private.enterprises.12356.101.4.1.3.0" => "forti_fw_use_cpu" 
        "iso.org.dod.internet.private.enterprises.12356.101.4.1.4.0" => "forti_fw_use_memory" 
        "iso.org.dod.internet.private.enterprises.12356.101.4.1.8.0" => "forti_fw_sessioncount" 
    } 
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2022, 1:44am UTC](https://discuss.elastic.co/t/inquiries-about-warning-fields/303695/2 "2022-05-30T01:44:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.