I think I might have misread the original post as having an issue with thresholds but not regular query @Anirudhan and @Anabella_Cristaldi. That's my bad there.
If you have non-ECS based source indexes then that would contribute to these signal issues where one type of rule might work but another will not work. You will want to audit your custom source index mappings to see if they're ECS compliant or not and ensure they do have mapping conflicts.
This sounds very probable in your current situation. We have noticed this recently on several different systems from users.
I can help you here do an audit here on the forum. Not a biggie. If you're ok with it, you can post your mappings of fort-traffic or other problematic source indexes with a query in dev tools like so:
GET fori-traffic*/_mapping
And then a sample test record (not real data) from your source index (please don't post any production or live data and do not violate any rules/laws by posing a data sample).
Using your test data cluster only, you would give me the first record or two like so from dev tools
GET fori-traffic/_search
Long term for the upcoming release we have improved bubbling up error conditions to the front end in several areas which should make finding and fixing these problems faster as well as eliminating several possibilities from users very quickly:
PR fixes that will show up in an upcoming release: