# Elastic 7.9.1 - Security (SIEM) - Your visualization has error(s) - \[illegal\_argument\_exception\]

**URL:** <https://discuss.elastic.co/t/elastic-7-9-1-security-siem-your-visualization-has-error-s-illegal-argument-exception/250265>\
**Category:** SIEM\
**Created:** [September 28, 2020, 11:19pm UTC](https://discuss.elastic.co/t/elastic-7-9-1-security-siem-your-visualization-has-error-s-illegal-argument-exception/250265 "2020-09-28T23:19:59Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![Derick\_Jansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/derick_jansen/32/71407_2.png) [@Derick\_Jansen](https://discuss.elastic.co/u/Derick_Jansen)\
**Post date:** [October 2, 2020, 2:23am UTC](https://discuss.elastic.co/t/elastic-7-9-1-security-siem-your-visualization-has-error-s-illegal-argument-exception/250265/7 "2020-10-02T02:23:29Z")

</div>

Hi @Andrew_G

I am seeing some strange behaviour. It seems like the template is being ignored.

I will step through what I have done. (I am testing only with Winlogbeat to make it easier)

```
DELETE /_template/winlogbeat-*
DELETE /winlogbeat-*

GET _template/winlogbeat-7.9.2/
{}
GET /winlogbeat-*
{}

```

Everything cleared out  
Run setup to create the template

```
 GET _template/winlogbeat-7.9.2/  

```

```auto
    ...
    "event" : {
      "properties" : {
        "severity" : {
          "type" : "long"
        },
        "code" : {
          "ignore_above" : 1024,
          "type" : "keyword"
        },
        "original" : {
          "ignore_above" : 1024,
          "type" : "keyword"
        },
        "risk_score" : {
          "type" : "float"
        },
        "timezone" : {
          "ignore_above" : 1024,
          "type" : "keyword"
        },
        "created" : {
          "type" : "date"
        },
        "kind" : {
          "ignore_above" : 1024,
          "type" : "keyword"
        },
        "module" : {
          "ignore_above" : 1024,
          "type" : "keyword"
        },
        ...

```

As we can see it created the template with event.module as a keyword.

Index is still empty at this point.

```
GET /winlogbeat-*/_mapping/field/event.module
{ }

```

Ingest some data ...

```
{
  "winlogbeat-7.9.2" : {
    "mappings" : {
      "event.module" : {
        "full_name" : "event.module",
        "mapping" : {
          "module" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          }
        }
      }
    }
  }
}

```

Problem is still there.

In short the template is correct but the index is created with the incorrect field type.

Any ideas? Thanks again I really appreciate all the help.

Cheers!

---

_[View the full topic](https://discuss.elastic.co/t/elastic-7-9-1-security-siem-your-visualization-has-error-s-illegal-argument-exception/250265)._