diff --git a/x-pack/plugins/observability_solution/infra/server/lib/alerting/common/utils.ts b/x-pack/plugins/observability_solution/infra/server/lib/alerting/common/utils.ts
index e91f80dccbac9..9c506d215355a 100644
--- a/x-pack/plugins/observability_solution/infra/server/lib/alerting/common/utils.ts
+++ b/x-pack/plugins/observability_solution/infra/server/lib/alerting/common/utils.ts
@@ -196,7 +196,7 @@ export const doFieldsExist = async (
   // Get all supported fields
   const respMapping = await esClient.fieldCaps({
     index,
-    fields: '*',
+    fields,
   });
 
   const fieldsExisted: Record<string, boolean> = {};
diff --git a/x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/utils.ts b/x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/utils.ts
index 2a7a69f591e8c..88f1febca71c0 100644
--- a/x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/utils.ts
+++ b/x-pack/plugins/observability_solution/observability/server/lib/rules/custom_threshold/utils.ts
@@ -130,7 +130,7 @@ export const doFieldsExist = async (
   // Get all supported fields
   const respMapping = await esClient.fieldCaps({
     index,
-    fields: '*',
+    fields,
   });
 
   const fieldsExisted: Record<string, boolean> = {};