When a signal is created it it contains a series of fields representing what i assume to be information regarding what triggered the rule. In particular is the
signal.parent.* fields (also
signal.parents.* - not that i understand the difference) which often contains a document id under singal.parent.id
. However when the entry is created by a threshold trigger it represents some other value that is not a document id (at least not the default format expected). ex. 00c876b0-bf18-11eb-a6e0-590e938f2721`
Attempts at searching for a document with that id fail and I presume it has something to with the how join queries are done. Though it might be the child parent relationship thing but could not figure out how to use it properly as none of the mappings specific any relationships, including the signals indices.
Does anyone know how to use the information in a threshold signal to retrieve the documents that triggered it?