I am having issues starting the ML datafeeds for SIEM, I've tried manually putting in a mapping for @timestamp as date but i still get this error anyone else have this issue ? ` "{"error":{"root_cause":[{"type":"status_exception","reason":"[datafeed-rare_process_by_host_windows_ecs] cannot retriev…

Elastic SIEM

Andrew_G (Andrew Macri) October 13, 2020, 2:59pm 2

Another person who encountered a similar error found the mapping issue via the instructions here.

Would you be willing to follow the steps suggested in the link above and post the output if those steps don't help resolve the error?

Topic		Replies	Views
Anomaly detection - Elastic Jobs failing to start SIEM elastic-stack-machine-learning	3	791	March 20, 2020
SIEM - troubleshooting various error SIEM	2	555	December 31, 2020
6.2.2 cannot run job: datafeed [XXX] cannot retrieve field [@timestamp] because it has no mappings Elasticsearch elastic-stack-machine-learning	3	1269	October 30, 2018
Trouble with Index Patterns SIEM	13	3809	August 2, 2019
SIEM does not show data SIEM	8	1497	May 21, 2020