Modifies description of (#3994)

elastic · Sep 29, 2023 · 2eeb1da · 2eeb1da
1 parent 007543c
commit 2eeb1da
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/docs/detections/api/rules/rules-api-create.asciidoc b/docs/detections/api/rules/rules-api-create.asciidoc
@@ -255,7 +255,7 @@ uses both `and` and `or` logic.
 |==============================================
 |Name |Type |Description
 
-|new_terms_fields |String[] |Fields to monitor for new values. Must contain 1–3 field names.
+|new_terms_fields |String[] |Fields to monitor for new values. Must contain 1 field name.
 
 |history_window_start |String |Start date to use when checking if a term has been seen before.
 Supports relative dates – for example, `now-30d` will search the last 30 days of data when checking if a term
@@ -833,7 +833,7 @@ POST api/detection_engine/rules
   "type": "new_terms",
   "language": "kuery",
   "query": "*",
-  "new_terms_fields": ["user.id", "source.ip"],
+  "new_terms_fields": ["user.id"],
   "history_window_start": "now-30d",
   "index": ["auditbeat*"]
 }
@@ -1196,7 +1196,7 @@ Example response for a new terms rule:
   ],
   "query": "*",
   "language": "kuery",
-  "new_terms_fields": ["user.id", "source.ip"],
+  "new_terms_fields": ["user.id"],
   "history_window_start": "now-30d",
   "related_integrations": [],       <1>
   "required_fields": [],            <1>

diff --git a/docs/detections/api/rules/rules-api-update.asciidoc b/docs/detections/api/rules/rules-api-update.asciidoc
@@ -173,7 +173,7 @@ uses both `and` and `or` logic.
 |==============================================
 |Name |Type |Description
 
-|new_terms_fields |String[] |Fields to monitor for new values. Must contain 1–3 field names.
+|new_terms_fields |String[] |Fields to monitor for new values. Must contain 1 field name.
 
 |history_window_start |String |Start date to use when checking if a term has been seen before.
 Supports relative dates – for example, `now-30d` will search the last 30 days of data when checking if a term