# Rule with index connector - issue with {{alert.id}}

**URL:** <https://discuss.elastic.co/t/rule-with-index-connector-issue-with-alert-id/324459>\
**Category:** Elastic Observability\
**Tags:** elastic-stack-alerting\
**Created:** [February 1, 2023, 4:31pm UTC](https://discuss.elastic.co/t/rule-with-index-connector-issue-with-alert-id/324459 "2023-02-01T16:31:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![justme123](https://avatars.discourse-cdn.com/v4/letter/j/f19dbf/32.png) [@justme123](https://discuss.elastic.co/u/justme123)\
**Post date:** [February 1, 2023, 4:31pm UTC](https://discuss.elastic.co/t/rule-with-index-connector-issue-with-alert-id/324459/1 "2023-02-01T16:31:40Z")

</div>

Hello all,

I hope that I write in a good place.

I'm newbie with ELK and I need help with rule.

So I have a rule with index connector, when I add

"alert.id": "{{alert.id}}"

in index in discover logs show me only :

alert.id : "\*"

I do not know how can I fix that.

Thanks in advance for any help.

---

<div class="post-metadata">

**Author:** ![simianhacker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simianhacker/32/3383_2.png) [@simianhacker](https://discuss.elastic.co/u/simianhacker)\
**Post date:** [February 1, 2023, 5:38pm UTC](https://discuss.elastic.co/t/rule-with-index-connector-issue-with-alert-id/324459/2 "2023-02-01T17:38:52Z")

</div>

Which rule is this?

---

<div class="post-metadata">

**Author:** ![justme123](https://avatars.discourse-cdn.com/v4/letter/j/f19dbf/32.png) [@justme123](https://discuss.elastic.co/u/justme123)\
**Post date:** [February 1, 2023, 6:09pm UTC](https://discuss.elastic.co/t/rule-with-index-connector-issue-with-alert-id/324459/3 "2023-02-01T18:09:28Z")

</div>

This is alert rule created by me. With index connector.

---

<div class="post-metadata">

**Author:** ![simianhacker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simianhacker/32/3383_2.png) [@simianhacker](https://discuss.elastic.co/u/simianhacker)\
**Post date:** [February 1, 2023, 8:46pm UTC](https://discuss.elastic.co/t/rule-with-index-connector-issue-with-alert-id/324459/4 "2023-02-01T20:46:09Z")

</div>

Right, but which rule type? Metric Threshold, Inventory Threshold, Log Threshold, Elasticsearch Query...

---

<div class="post-metadata">

**Author:** ![justme123](https://avatars.discourse-cdn.com/v4/letter/j/f19dbf/32.png) [@justme123](https://discuss.elastic.co/u/justme123)\
**Post date:** [February 1, 2023, 9:09pm UTC](https://discuss.elastic.co/t/rule-with-index-connector-issue-with-alert-id/324459/5 "2023-02-01T21:09:52Z")

</div>

This is Log threshold

---

<div class="post-metadata">

**Author:** ![simianhacker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simianhacker/32/3383_2.png) [@simianhacker](https://discuss.elastic.co/u/simianhacker)\
**Post date:** [February 1, 2023, 10:38pm UTC](https://discuss.elastic.co/t/rule-with-index-connector-issue-with-alert-id/324459/6 "2023-02-01T22:38:13Z")

</div>

Thanks... for the Log Threshold Rule when you set a "group by" field, like `host.name`, then the `alert.id` would equal the value of the `host.name`, like `db.foo.com`. For Log Threshold rules without a "group by" field, we set the `alert.id` to `*` (an asterisk), which represents "everything".