DNS Tunneling job failing to start

Elastic Security SIEM
1

I have a similar issue to this thread (Anomaly detection - Elastic Jobs failing to start).

When I try to start the job packetbeat_dns_tunneling, I get the error [datafeed-packetbeat_dns_tunneling] cannot retrieve field [dns.question.etld_plus_one] because it has no mappings

I ran this command

GET _ml/datafeeds/datafeed-packetbeat_dns_tunneling

and under indices, got the output

"indices": [
"packetbeat-",
"logs-"
],

Is this what the job is supposed to map to, or is it supposed to map to something else? packetbeat and logs are where we are getting our logs from.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.