# Failure authentication not displayed at "security-hosts-authentications" **URL:** \ **Category:** Kibana\ **Created:** [October 31, 2021, 2:42pm UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096 "2021-10-31T14:42:50Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![sadux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sadux/32/96568_2.png) [@sadux](https://discuss.elastic.co/u/sadux)\ **Post date:** [October 31, 2021, 2:42pm UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096/1 "2021-10-31T14:42:51Z")
Hello! Just upgrade Kibana and Elasticsearch from 7.8 to 7.15.1 and found, that Failure authentications not displayed at "security-hosts-authentications". With Success auth all good and they displayed at Authentications section. But fail auth I see only at User authentications counters. What could be the problem with? ---
**Author:** ![sadux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sadux/32/96568_2.png) [@sadux](https://discuss.elastic.co/u/sadux)\ **Post date:** [November 1, 2021, 11:38am UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096/2 "2021-11-01T11:38:21Z")
Found, that failure auth provide username at "user.effective.name" and success auth at "user.name". Dashboard request require "user.name" field. How I can resolve this problem? Maybe I can rename "user.effective.name" at "user.name" or change dashboard request? ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [November 1, 2021, 12:37pm UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096/3 "2021-11-01T12:37:43Z")
There has probably been a change in mapping between the two versions. You can either change the dashboard to use the new field name or use a field alias to point to the new name. > **[Alias field type | Elasticsearch Guide \[master\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/field-alias.html)** ---
**Author:** ![sadux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sadux/32/96568_2.png) [@sadux](https://discuss.elastic.co/u/sadux)\ **Post date:** [November 1, 2021, 12:49pm UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096/4 "2021-11-01T12:49:10Z")
> [@Marius\_Dragomir](#): > > You can either change the dashboard to use the new field name Can you say, how I can modify standart Dashboard? (for example "Inspect Authentications")? ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [November 1, 2021, 12:50pm UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096/5 "2021-11-01T12:50:32Z")
if they are in the Dashboards app, just select switch to edit mode in the top right of the screen and then you can edit any visualization on that dashboard. ---
**Author:** ![sadux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sadux/32/96568_2.png) [@sadux](https://discuss.elastic.co/u/sadux)\ **Post date:** [November 1, 2021, 1:53pm UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096/6 "2021-11-01T13:53:21Z")
> [@Marius\_Dragomir](#): > > if they are in the Dashboards app, just select switch to edit mode in the top right of the screen and then you can edit any visualization on that dashboard. Maybe you can help with alias? What i should add to index template alias for rename user.effective.name to user.name? ---
**Author:** ![sadux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sadux/32/96568_2.png) [@sadux](https://discuss.elastic.co/u/sadux)\ **Post date:** [November 1, 2021, 2:44pm UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096/7 "2021-11-01T14:44:36Z")
Downgrade to 7.8.1 auditbeat - all works fine.. But it's not good way ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [November 1, 2021, 2:57pm UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096/8 "2021-11-01T14:57:30Z")
Yes, if that is done, you don't need to upgrade the dashboard. If it's a dashboard shipped with Auditbeat, you can import the news ones after upgrading auditbeat to 7.15.1. ---
**Author:** ![sadux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sadux/32/96568_2.png) [@sadux](https://discuss.elastic.co/u/sadux)\ **Post date:** [November 10, 2021, 10:48am UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096/9 "2021-11-10T10:48:30Z")
Problem was solved - removed old index pattern, update pattern and configure processors drop\_event at auditbeat config. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 8, 2021, 10:49am UTC](https://discuss.elastic.co/t/failure-authentication-not-displayed-at-security-hosts-authentications/288096/10 "2021-12-08T10:49:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.