security_monitoring - Add indexes to deprecate index in ruleQuery

content/en/api/v2/security-monitoring/request.CreateSecurityMonitoringRule_868881438.json

@@ -6,7 +6,9 @@
       "aggregation": "count",
       "groupByFields": [],
       "distinctFields": [],
-      "index": "main"
+      "indexes": [
+        "main"
+      ]
     }
   ],
   "filters": [],

data/api/v2/full_spec.yaml

@@ -44568,6 +44568,14 @@ components:
             for scheduled rules - in other words, when the `schedulingOptions` field
             is present in the rule payload.'
           type: string
+        indexes:
+          description: List of indexes to query when the `dataSource` is `logs`. Only
+            used for scheduled rules, such as when the `schedulingOptions` field is
+            present in the rule payload.
+          items:
+            description: Index.
+            type: string
+          type: array
         metric:
           deprecated: true
           description: '(Deprecated) The target field to aggregate over when using