diff --git a/doc/userguide/output/eve/eve-json-format.rst b/doc/userguide/output/eve/eve-json-format.rst
index 135af01539..718c12ca2e 100644
--- a/doc/userguide/output/eve/eve-json-format.rst
+++ b/doc/userguide/output/eve/eve-json-format.rst
@@ -409,6 +409,12 @@ In firewall mode, the ``alert.engine`` field identifies which rule engine
 generated the alert: ``fw`` for firewall rules and ``td`` for threat detect
 rules. This field is omitted outside of firewall mode.
 
+Alerts for a packet with the ``decoder.ethernet.unknown_ethertype`` event, such
+as alerts from a rule using ``decode-event:ethernet.unknown_ethertype``, have a
+top-level ``unknown_ether_type`` field holding the ethertype the decoder could
+not handle. Anomaly records for the packet have the same field, but alerts
+have it whether or not decode anomalies are logged.
+
 This event will also have the ``pcap_cnt`` field, when running in pcap mode, to
 indicate which packet triggered the signature.
 
diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst
index 2d89d7605c..b7cfbda4c7 100644
--- a/doc/userguide/upgrade.rst
+++ b/doc/userguide/upgrade.rst
@@ -60,6 +60,7 @@ Logging Changes
 - Anomaly records for a packet with the ``decoder.ethernet.unknown_ethertype``
   event now include the ethertype the decoder could not handle in a top-level
   ``unknown_ether_type`` field.
+  Alerts for a packet with that event have the same field.
 
 - Alert verdict key is changed from to ``reject-target`` to ``reject_target``