# Rule Failure - Rule Mapping Error

**URL:** <https://discuss.elastic.co/t/rule-failure-rule-mapping-error/301827>\
**Category:** Elastic Security\
**Created:** [April 7, 2022, 5:03am UTC](https://discuss.elastic.co/t/rule-failure-rule-mapping-error/301827 "2022-04-07T05:03:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![inf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inf/32/85793_2.png) [@inf](https://discuss.elastic.co/u/inf)\
**Post date:** [April 7, 2022, 5:03am UTC](https://discuss.elastic.co/t/rule-failure-rule-mapping-error/301827/1 "2022-04-07T05:03:46Z")

</div>

Hi there,

I am facing the same issue as [Rules failing due to field mapping errors](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981), except that I am using Winlogbeat. (instead of Auditbeat)

I am also not using Logstash or any log transformation tools, and I am using the latest Elasticsearch, Kibana, and Winlogbeat versions (v8.1.2).

The error message is: `An error occurred during rule execution: message: "verification_exception: [verification_exception] Reason: Found 1 problem line 4:8: first argument of [cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")] must be [ip], found value [destination.ip] type [text]" name: "Unusual Network Connection via DllHost" id: "e7ab0a0c-b614-11ec-a5b7-adfb0ac547ad" rule id: "c7894234-7814-44c2-92a9-f7d851ea246a" execution id: "cf64291c-0cb4-4993-852d-011887f4e9c6" space ID: "default"`

An example of such a rule failing is `Unusual Network Connection via DllHost`.

Under `Data views` for `winlogbeat-*`, I see that my `destination.ip` field has the `text` type.

Thank you for your time & help in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 5, 2022, 5:04am UTC](https://discuss.elastic.co/t/rule-failure-rule-mapping-error/301827/2 "2022-05-05T05:04:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.