# Issue creating index with alert **URL:** \ **Category:** SIEM\ **Created:** [October 27, 2022, 11:10am UTC](https://discuss.elastic.co/t/issue-creating-index-with-alert/317604 "2022-10-27T11:10:16Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Florian-LB](https://avatars.discourse-cdn.com/v4/letter/f/b487fb/32.png) [@Florian-LB](https://discuss.elastic.co/u/Florian-LB)\ **Post date:** [October 27, 2022, 11:10am UTC](https://discuss.elastic.co/t/issue-creating-index-with-alert/317604/1 "2022-10-27T11:10:16Z")
Hi, I want to setup an alert when 3 login rejections occur on the same switch in order to get this info on my dashboard. I created a threshold rule “Alerte Brute Force Cisco” that raise an alert when 3 authentications are rejected on a same switch on the last 7 minutes (the rule in executed every 5 minutes). ![list rules](https://us1.discourse-cdn.com/elastic/original/3X/a/f/afb36540a6666c60b095148523f33e24b0336362.png) ![rule-setup](https://us1.discourse-cdn.com/elastic/original/3X/a/8/a8ff0fafc8075abb0896042b0de1833fd4de327c.png) I created a connector with the CLI using this command. ![connector-creation](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7c5124d5f27a7a8657ff3074ef9b4ba65eb1fd63.png) I added this as an index connector to the rule with the following document to index. ![setup index connector on rule](https://us1.discourse-cdn.com/elastic/original/3X/2/2/229ef225d5d42cf8db54933b2dd6af7e2ce1c22d.png) By doing this I am trying to create a data stream that I can use in the dashboard. After that I did 3 rejected login authentications. The alert is raised but we can see an error in the log of the rule: ![error-log](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a733cc54ab0c5753560c2e5720055715797bdfd8.png) I tried to test the connector like this, but it failed showing the same error: ![connector](https://us1.discourse-cdn.com/elastic/original/3X/6/6/667f29ef17eb65478463e383ab698e1b4649bae6.png) ![test-connector-1](https://us1.discourse-cdn.com/elastic/original/3X/5/4/54868e78a0465adc19c3e192a256f675aacb9893.png) ![test-connector-2](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f2d5e6b1293eb1392d92955d44a93cee060f075.png) In Discover, I wanted to create a data view, but I can only see an index and not a data stream in the matching results. The index showing me nothing at all. ![create data view](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a5f5c508f50bc8f1b9006f5d2511aa80bf3c74a1.png) In the Index Management, you can see an Indice named “alert-brute-force-cisco” but there is nothing else for this in Data Stream, Index Template and Component Table. ![indice](https://us1.discourse-cdn.com/elastic/original/3X/8/8/88351428141b6c8b11cb8ee7d7af1be82fe2cb25.png) I absolutely don’t know what I’m missing or if I’m doing it right. I hope that my explanations are clear and that someone can help me. Florian ---
**Author:** ![Florian-LB](https://avatars.discourse-cdn.com/v4/letter/f/b487fb/32.png) [@Florian-LB](https://discuss.elastic.co/u/Florian-LB)\ **Post date:** [October 27, 2022, 12:14pm UTC](https://discuss.elastic.co/t/issue-creating-index-with-alert/317604/2 "2022-10-27T12:14:25Z")
Removing the "\*" in the index field in "Write to the index" while editing the connector solved the problem. My bad. ---
**Author:** ![RylandHerrick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rylandherrick/32/67401_2.png) [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)\ **Post date:** [October 27, 2022, 3:14pm UTC](https://discuss.elastic.co/t/issue-creating-index-with-alert/317604/3 "2022-10-27T15:14:30Z")
@Florian-LB glad you found a resolution! We have captured this issue in a bug here: [[Alerting] [Connector] Index connector suggests wildcard usage · Issue #113511 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/113511). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 24, 2022, 3:15pm UTC](https://discuss.elastic.co/t/issue-creating-index-with-alert/317604/4 "2022-11-24T15:15:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.