The field "event_id" is mostly used for the notable events, in the itsi_tracked_alerts field.
but in versions older than 3.* it was also used for the group id in the index=itsi_grouped_alerts, and since 4.* for the Episodes ids too.
This can be confusions, as there is also an itsi_group_id field and when you use the API, the id may be referring to the notable or to the group...
The best way to avoid confusion is to do an eval or a rename to create a second field group_id to avoid confusion, depending of the context of the data.
... View more