# Failed to fetch rules and timelines: Failed to parse field \[filter\]: x\_content\_parse\_exception

**URL:** <https://discuss.elastic.co/t/failed-to-fetch-rules-and-timelines-failed-to-parse-field-filter-x-content-parse-exception/269624>\
**Category:** SIEM\
**Tags:** elastic-stack-security\
**Created:** [April 8, 2021, 4:33pm UTC](https://discuss.elastic.co/t/failed-to-fetch-rules-and-timelines-failed-to-parse-field-filter-x-content-parse-exception/269624 "2021-04-08T16:33:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aditi\_salunke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditi_salunke/32/85600_2.png) [@aditi\_salunke](https://discuss.elastic.co/u/aditi_salunke)\
**Post date:** [April 8, 2021, 4:33pm UTC](https://discuss.elastic.co/t/failed-to-fetch-rules-and-timelines-failed-to-parse-field-filter-x-content-parse-exception/269624/1 "2021-04-08T16:33:04Z")

</div>

![failed02](https://us1.discourse-cdn.com/elastic/original/3X/2/4/24b59deee1a79dd39abcbfa715748308bf2ae3fd.png)  
 ![failed03](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b62ed4af7ace88a09ce8c74575dd2ef4ee739c82.png)  
 ![failed04](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a7cbd1cc6727eb72d49e7e73132a204f87944152.png)  
I am unable to find what went wrong.  
Can anyone help me out ?

PS: 1)Not able to see pre-configured rules and customised one(for superuser role)  
2)No alert is getting triggered

---

<div class="post-metadata">

**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\
**Post date:** [April 13, 2021, 12:43am UTC](https://discuss.elastic.co/t/failed-to-fetch-rules-and-timelines-failed-to-parse-field-filter-x-content-parse-exception/269624/2 "2021-04-13T00:43:05Z")

</div>

Hey there @aditi_salunke 👋

This appears similar to [Detection Custom Rule not working](https://discuss.elastic.co/t/detection-custom-rule-not-working/269578), however you're also experiencing it on the Stack Monitoring page it looks like? Are you seeing this error anywhere else by chance?

Also noted that this occurs when using a user with the `superuser` role -- can you share the current user's role definition, and any configured document level security options that may be present? Similar type errors can bubble up from ES when there's something wrong with those configurations.

In addition, can you verify the following?

- What version and type of deployment are you on?
- Did this start happening after a specific configuration change, or addition of new rules? If so, can you provide more details as to what changes, or the rules in question?

Thanks!  
Garrett

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [April 29, 2021, 3:42pm UTC](https://discuss.elastic.co/t/failed-to-fetch-rules-and-timelines-failed-to-parse-field-filter-x-content-parse-exception/269624/3 "2021-04-29T15:42:03Z")

</div>

Through other conversations this was solved by:

```auto
There was version compability issue between elasticsearch(v12) and kibana(v10).
Upgrading the kibana solved all the issues.

```

If you haven't yet, I would recommend keeping those two in sync and this problem should be resolved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2021, 3:42pm UTC](https://discuss.elastic.co/t/failed-to-fetch-rules-and-timelines-failed-to-parse-field-filter-x-content-parse-exception/269624/4 "2021-05-27T15:42:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.