I want to know how the data for this rule came about. I set the discard processor for the pipeline (default and final pipeline) corresponding to the document I submitted, but it still triggers an alarm. I didn't see the document data I requested on discover, and my pipeline has been tested and can be discarded normally. However, this alarm can still be triggered, and the kql syntax is not useful, it still triggers an alarm.