doc/alert: describe unknown_ether_type in alerts

Describe the top-level "unknown_ether_type" field that alerts for
packets with the decoder.ethernet.unknown_ethertype event now carry,
and note it in the upgrade guide.

Issue: 7849
Issue: 8142

doc/userguide/output/eve/eve-json-format.rst

@@ -409,6 +409,12 @@ In firewall mode, the ``alert.engine`` field identifies which rule engine
 generated the alert: ``fw`` for firewall rules and ``td`` for threat detect
 rules. This field is omitted outside of firewall mode.
 
+Alerts for a packet with the ``decoder.ethernet.unknown_ethertype`` event, such
+as alerts from a rule using ``decode-event:ethernet.unknown_ethertype``, have a
+top-level ``unknown_ether_type`` field holding the ethertype the decoder could
+not handle. Anomaly records for the packet have the same field, but alerts
+have it whether or not decode anomalies are logged.
+
 This event will also have the ``pcap_cnt`` field, when running in pcap mode, to
 indicate which packet triggered the signature.
 

doc/userguide/upgrade.rst

@@ -60,6 +60,7 @@ Logging Changes
 - Anomaly records for a packet with the ``decoder.ethernet.unknown_ethertype``
   event now include the ethertype the decoder could not handle in a top-level
   ``unknown_ether_type`` field.
+  Alerts for a packet with that event have the same field.
 
 - Alert verdict key is changed from to ``reject-target`` to ``reject_target``