# Kibana rules - Is it anyhow possible to source document that was hit against rule?

**URL:** <https://discuss.elastic.co/t/kibana-rules-is-it-anyhow-possible-to-source-document-that-was-hit-against-rule/370255>\
**Category:** Kibana\
**Created:** [November 9, 2024, 1:24pm UTC](https://discuss.elastic.co/t/kibana-rules-is-it-anyhow-possible-to-source-document-that-was-hit-against-rule/370255 "2024-11-09T13:24:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dawid\_Popiela](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dawid_popiela/32/138072_2.png) [@Dawid\_Popiela](https://discuss.elastic.co/u/Dawid_Popiela)\
**Post date:** [November 9, 2024, 1:24pm UTC](https://discuss.elastic.co/t/kibana-rules-is-it-anyhow-possible-to-source-document-that-was-hit-against-rule/370255/1 "2024-11-09T13:24:35Z")

</div>

Hi, as tittle says is it possible to gather document in kibana rule that was hit?

My usecase is like this that I am using inventory treshold rule for kubernetes pods to check memory usage treshold. I am ussing index connector and write it futher to index. I gathered full context object and it is missing pod name.  
Is is possible to reach source document containing pod name?

Somewhere on internet I found syntax: {{.source.kubernetes.pod.name}} however in my case is null.

Just to confirm in document that is analyzed there is kubernetes.pod.name properly populated but I can't find any way to get it in rule writting to index.

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [November 12, 2024, 7:20pm UTC](https://discuss.elastic.co/t/kibana-rules-is-it-anyhow-possible-to-source-document-that-was-hit-against-rule/370255/2 "2024-11-12T19:20:02Z")

</div>

@pmuellr /@ying.mao can we please get some help?

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![Dawid\_Popiela](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dawid_popiela/32/138072_2.png) [@Dawid\_Popiela](https://discuss.elastic.co/u/Dawid_Popiela)\
**Post date:** [November 21, 2024, 4:57pm UTC](https://discuss.elastic.co/t/kibana-rules-is-it-anyhow-possible-to-source-document-that-was-hit-against-rule/370255/3 "2024-11-21T16:57:06Z")

</div>

bump, possbile for any hint/help?