# Having Issue with Data indexing

**URL:** <https://discuss.elastic.co/t/having-issue-with-data-indexing/323581>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 20, 2023, 10:07am UTC](https://discuss.elastic.co/t/having-issue-with-data-indexing/323581 "2023-01-20T10:07:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Danish\_Ibrar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danish_ibrar/32/116205_2.png) [@Danish\_Ibrar](https://discuss.elastic.co/u/Danish_Ibrar)\
**Post date:** [January 20, 2023, 10:07am UTC](https://discuss.elastic.co/t/having-issue-with-data-indexing/323581/1 "2023-01-20T10:07:09Z")

</div>

I'm Having an issue I've just deployed the Custom decoders and rules they being triggered but data is not indexed to elastic default alerts are indexed but not for custom rules

---

<div class="post-metadata">

**Author:** ![ying.mao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ying.mao/32/88151_2.png) [@ying.mao](https://discuss.elastic.co/u/ying.mao)\
**Post date:** [January 20, 2023, 3:47pm UTC](https://discuss.elastic.co/t/having-issue-with-data-indexing/323581/2 "2023-01-20T15:47:48Z")

</div>

Hi @Danish_Ibrar! Can you provide some more details as to the rule type that you are using and what you mean by elastic default alerts? Do you mean the `.alerts-*` indices?

---

<div class="post-metadata">

**Author:** ![Danish\_Ibrar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danish_ibrar/32/116205_2.png) [@Danish\_Ibrar](https://discuss.elastic.co/u/Danish_Ibrar)\
**Post date:** [January 23, 2023, 6:11am UTC](https://discuss.elastic.co/t/having-issue-with-data-indexing/323581/3 "2023-01-23T06:11:10Z")

</div>

yes I'm actually writing custom decoders for wazuh but filebeat is unable to index data to Elasticsearch. After I restart all the services the latest log I see for filebeat is "Attempting to connect to elasticsearch"

---

<div class="post-metadata">

**Author:** ![Danish\_Ibrar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danish_ibrar/32/116205_2.png) [@Danish\_Ibrar](https://discuss.elastic.co/u/Danish_Ibrar)\
**Post date:** [January 23, 2023, 6:13am UTC](https://discuss.elastic.co/t/having-issue-with-data-indexing/323581/4 "2023-01-23T06:13:32Z")

</div>

decoders are working fine

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 20, 2023, 6:14am UTC](https://discuss.elastic.co/t/having-issue-with-data-indexing/323581/5 "2023-02-20T06:14:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.