← Back to the library
Visibility

A log is a record. An alert is a decision.

Collecting events and deciding what deserves attention are different jobs.

Prepared November 7, 2026 · Educational explainer · Illustrative example

Dash-Squared editorial · Last reviewed November 7, 2026

Collecting events and deciding what deserves attention are different jobs.
Illustrative model / Visibility
Look inside the idea

A record is not an alert.

Detection / separate the evidence, the condition and the follow-up.

A record is not an alert.Detection / separate the evidence, the condition and the follow-up. No alert is not proof that nothing happened.DASH-SQUARED / THE VISUAL FIELD GUIDEA record is not an alert.Detection / separate the evidence, the condition and the follow-up.1 / COLLECTED RECORDS09:00 Sign-in failed09:01 Sign-in failed09:02 Sign-in failed2 / EXAMPLE RULE3 failures insidea 5-minute window3 / ALERTNeeds reviewNot a verdictA record describes an event.A rule or detection interprets a pattern.The threshold here is fictional.An alert starts the investigation.Missing data, rule coverage and routingcan all explain why an alert is absent.No alert is not proof that nothing happened.Illustrative model · Read the explanation, limits and sources alongside it.
Three fictional failed-sign-in records feed an example rule: three failures within five minutes. A matching rule creates an alert for review, not a confirmed finding. Missing collection or coverage can hide events. Open full graphic ↗

Follow the idea

  1. The system collects three fictional failed-sign-in records.
  2. An example condition looks for three failures within five minutes.
  3. A matching condition produces an alert for investigation.

Keep the limit visible

Synthetic threshold, not security advice. Detection and notification behavior depend on rule type, deployment and configuration.

Does this alert prove an attack happened?

No. A user typing an old password might match this fictional rule. An event that was never collected could be missed entirely.

A common assumption

“No alert means nothing happened.”

Collection, detection coverage and notification routing can each have gaps.

Source for this graphic: www.elastic.co ↗ · Checked November 7, 2026 · Illustrative example.

In this explanation01Keep the record02Choose what needs attention03Ask about the gaps04The next smart question

Keep the record

Logs record events emitted by systems and applications. They can help someone reconstruct what happened, provided the relevant data was collected and remains available.

Choose what needs attention

An alert is a notification produced when a configured condition or detection is met. Illustrative example: sign-in events arrive as records; a rule identifies a pattern and creates an alert for someone to investigate.

Ask about the gaps

No alert is not proof that nothing happened. Missing data, configuration, rule coverage and review processes can all affect what becomes visible.

The next smart question

Which events are collected, and what turns those records into something someone investigates?

Source notes · checked November 7, 2026www.elastic.co · original source ↗

Independent explanation. No sponsorship or endorsement implied. Product features and policies can change; check the exact product and configuration.

Published .