# Rule Changing By Itself?

**URL:** <https://discuss.elastic.co/t/rule-changing-by-itself/370787>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [November 19, 2024, 6:47pm UTC](https://discuss.elastic.co/t/rule-changing-by-itself/370787 "2024-11-19T18:47:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kris\_Felscher](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kris_felscher/32/125461_2.png) [@Kris\_Felscher](https://discuss.elastic.co/u/Kris_Felscher)\
**Post date:** [November 19, 2024, 6:47pm UTC](https://discuss.elastic.co/t/rule-changing-by-itself/370787/1 "2024-11-19T18:47:02Z")

</div>

We have a rule that seems to have modified itself somehow.

Previously the filter for the rule was "healthcheckname : **name** and not healthstatus : **Healthy**"

However, around midnight last night the filter got modified to: "healthcheckname : _ **Warning** _ and not healthstatus : **Warning**"

All of this is very weird because I am the only person with the rights to change rules, and I don't sleepwalk or take ambien 😃

Any ideas what could have happened?

**UPDATE:**

It happened again. Last night, 15 alerts mysteriously changed to use **Data View:** \* instead of the correct index.

I see absolutely no logs indicating that they were edited. We just suddenly started getting spammed with alert emails.

---

<div class="post-metadata">

**Author:** ![adilraad2001](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adilraad2001/32/138356_2.png) [@adilraad2001](https://discuss.elastic.co/u/adilraad2001)\
**Post date:** [November 21, 2024, 3:13pm UTC](https://discuss.elastic.co/t/rule-changing-by-itself/370787/2 "2024-11-21T15:13:15Z")

</div>

Maybe you need to do another check for logs of the service and users and check the roles and api  
also change password