# Incorrect Kibana Mappings From Winlogbeats Setup Command

**URL:** <https://discuss.elastic.co/t/incorrect-kibana-mappings-from-winlogbeats-setup-command/309953>\
**Category:** Beats\
**Created:** [July 18, 2022, 9:37pm UTC](https://discuss.elastic.co/t/incorrect-kibana-mappings-from-winlogbeats-setup-command/309953 "2022-07-18T21:37:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jared9922](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jared9922/32/99712_2.png) [@Jared9922](https://discuss.elastic.co/u/Jared9922)\
**Post date:** [July 18, 2022, 9:37pm UTC](https://discuss.elastic.co/t/incorrect-kibana-mappings-from-winlogbeats-setup-command/309953/1 "2022-07-18T21:37:25Z")

</div>

I have installed Winlogbeat on my computer and data seems to be flowing correctly. My data flows through my stack as shown  
Winlogbeat -\> logstash -\> elasticsearch  
I am trying to setup the index templates for Winlogbeat using the commands specified in the documentation, but the mapping seems to be incorrect. When I open a kibana dashboard I get the following error:

"1 of 2 shards failed. Expanding the error shows me the following message

Illegal argument exception  
Text fields are not optimized for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [winlog.event\_id] in order to load field data by uninverting the inverted index. Note that this can use significant memory"

This error is strange to me because I am using the indexes that were setup through Winlogbeat.

I have tried the following:

Deleting all indexes, index templates, and data streams that were associated with Winlogbeat.  
Re-running this setup command: ./winlogbeat.exe setup. This command yields the following output

"Overwriting ILM policy is disabled. Set 'setup.ilm.overwrite: true' for enabling.

Index setup finished.  
Loading dashboards (Kibana must be running and reachable)  
Loaded dashboards  
Loaded Ingest pipelines"

Then restarting Winlogbeat. This doesn't fix the bug and I run into the same issue.

I have tried a few things and just seem to be running in circles. Any help would be greatly appreciated.

A few questions that I've been thinking:  
What is ILM policy? Should it be enabled?  
Is there a different way to setup that will produce the correct mapping?

Links I have looked into:  
[[Bug] [auditbeat] [winlogbeat] Running `setup` with `setup.ilm.check_exists: false` creates invalid mappings (`text` for `keyword` fields), effecting the Security app · Issue #21725 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/21725)

[Elastic 7.9.1 - Security (SIEM) - Your visualization has error(s) - [illegal\_argument\_exception] - Elastic Security / SIEM - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-7-9-1-security-siem-your-visualization-has-error-s-illegal-argument-exception/250265/7)

My winlogbeat.yml file doesn't have a

```auto
setup.ilm.check_exists: false

```

line.

Here is a screenshot of the error I am getting.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e01e025f85f4cdc9767d04913a67cdcad435a0d5.png)

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [July 19, 2022, 10:07am UTC](https://discuss.elastic.co/t/incorrect-kibana-mappings-from-winlogbeats-setup-command/309953/2 "2022-07-19T10:07:36Z")

</div>

Have you tried installing the latest winlogbeat?

---

<div class="post-metadata">

**Author:** ![Jared9922](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jared9922/32/99712_2.png) [@Jared9922](https://discuss.elastic.co/u/Jared9922)\
**Post date:** [July 19, 2022, 3:47pm UTC](https://discuss.elastic.co/t/incorrect-kibana-mappings-from-winlogbeats-setup-command/309953/3 "2022-07-19T15:47:24Z")

</div>

Would I have to update my entire stack? I am using Winlogbeat 8.2.3  
It was the latest a few weeks ago

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2022, 3:47pm UTC](https://discuss.elastic.co/t/incorrect-kibana-mappings-from-winlogbeats-setup-command/309953/4 "2022-08-16T15:47:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.