# Error in threshold rules when using ECS

**URL:** <https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899>\
**Category:** Elasticsearch\
**Created:** [December 3, 2021, 12:40pm UTC](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899 "2021-12-03T12:40:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nameless](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nameless/32/97753_2.png) [@nameless](https://discuss.elastic.co/u/nameless)\
**Post date:** [December 3, 2021, 12:40pm UTC](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899/1 "2021-12-03T12:40:05Z")

</div>

Hello

The following error occurs when the rule is running.  
Please help me understand the reason

```auto
Bulk Indexing of signals failed: Could not dynamically add mapping for field [source.ip.keyword]. Existing mapping for [source.ip] must be of type object but found [ip]. name: "portal_401_auth_url" id: "a6a383a0-5120-11ec-8c9b-252e6168d6fb" rule id: "966a2a33-84a6-4d54-bc12-334542b02c9b" signals index: ".siem-signals-default" 

```

````auto
GET /fortiweb-logs-2021.12/_mapping/field/source.ip
{
  "fortiweb-logs-2021.12" : {
    "mappings" : {
      "source.ip" : {
        "full_name" : "source.ip",
        "mapping" : {
          "ip" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          }
        }
      }
    }
  }
}```

I used rename to align with ECS:

````

rename =\> {  
"syslog5424\_pri" =\> "[log][syslog][priority]"  
"[device\_id]"=\> "[observer][serial\_number]"  
"[log\_id]"=\> "[event][code]"  
"[msg\_id]"=\> "[event][sequence]"  
"[msg]"=\> "[message]"  
"[policy]"=\> "[rule][ruleset]"  
"[action]"=\> "[event][action]"  
"[cipher\_suite]"=\> "[tls][cipher]"  
"[dst]"=\> "[destination][ip]"  
"[http\_agent]"=\> "[user\_agent][original]"  
"[http\_host]"=\> "[url][domain]"  
"[http\_method]"=\> "[http][request][method]"  
"[http\_refer]"=\> "[http][request][referrer]"  
"[http\_request\_bytes]"=\> "[http][request][bytes]"  
"[http\_request\_time]"=\> "[http][request][duration]"  
"[http\_response\_bytes]"=\> "[http][response][bytes]"  
"[http\_response\_time]"=\> "[http][response][duration]"  
"[http\_retcode]"=\> "[http][response][status\_code]"  
"[http\_url]"=\> "[url][path]"  
"[http\_version]"=\> "[http][version]"  
"[protocol]"=\> "[network][transport]"  
"[reason]"=\> "[event][reason]"  
"[service]"=\> "[network][protocol]"  
"[signature\_cve\_id]"=\> "[vulnerability][id]"  
"[src\_ip]"=\> "[source][ip]"  
"[source\_port]"=\> "[source][port]"  
"[threat\_level]"=\> "[vulnerability][severity]"  
"[user]"=\> "[user][name]"  
"[timezone]"=\> "[event][timezone]"  
"[username]"=\> "[user][name]"  
"[log\_level]"=\> "[log][level]"  
"[destinastion\_port]"=\> "[destination][port]"  
"[dst\_ip]"=\> "[destination][ip]"  
"[original\_src\_country]"=\> "[geo][country\_name]"  
"[http\_user\_agent]"=\> "[user\_agent][original]"  
"[http\_retry\_code]"=\> "[http][response][status\_code]"  
}

```auto

```

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 6, 2021, 1:55am UTC](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899/2 "2021-12-06T01:55:04Z")

</div>

Welcome to our community! 😃

It means you have something that is inserting an [object](https://www.elastic.co/guide/en/elasticsearch/reference/current/object.html) and not a keyword. You might need to find out where that is coming from.

---

<div class="post-metadata">

**Author:** ![nameless](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nameless/32/97753_2.png) [@nameless](https://discuss.elastic.co/u/nameless)\
**Post date:** [December 6, 2021, 7:12am UTC](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899/3 "2021-12-06T07:12:33Z")

</div>

Hello.

Tell me how you can determine who is doing this. The source of the data is only logstash. I apologize for the possibly stupid questions. I am just starting to use elastic.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2022, 7:13am UTC](https://discuss.elastic.co/t/error-in-threshold-rules-when-using-ecs/290899/4 "2022-01-03T07:13:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.