# Indicator false match on ipv6

**URL:** <https://discuss.elastic.co/t/indicator-false-match-on-ipv6/258521>\
**Category:** Elastic Security\
**Created:** [December 14, 2020, 12:28am UTC](https://discuss.elastic.co/t/indicator-false-match-on-ipv6/258521 "2020-12-14T00:28:28Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![hilt86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilt86/32/20308_2.png) [@hilt86](https://discuss.elastic.co/u/hilt86)\
**Post date:** [December 15, 2020, 5:22am UTC](https://discuss.elastic.co/t/indicator-false-match-on-ipv6/258521/5 "2020-12-15T05:22:10Z")

</div>

There aren't any mappings really `{}` as it inherits the mapping from filebeat-\* I would think (see [Filebeat Apache Module Change Index Name](https://discuss.elastic.co/t/filebeat-apache-module-change-index-name/176955/2))

What do you mean "lists are smaller than the data sets"?

---

_[View the full topic](https://discuss.elastic.co/t/indicator-false-match-on-ipv6/258521)._