# Rules failing due to field mapping errors **URL:** \ **Category:** Elastic Security\ **Created:** [October 18, 2021, 11:25am UTC](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981 "2021-10-18T11:25:12Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![PD98](https://avatars.discourse-cdn.com/v4/letter/p/ea5d25/32.png) [@PD98](https://discuss.elastic.co/u/PD98)\ **Post date:** [October 18, 2021, 11:25am UTC](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981/1 "2021-10-18T11:25:12Z")
Hi, I have enabled elastic security and activated the rules. I am using auditbeat to collect audit data and send it to logstash which then indexes it in elasticsearch. I am not performing any mutation on the logs via logstash, and using default mapping. However some of the rules are failing during execution with the reason "first argument of {rule} must be [ip], found value [destination.ip] type [text]". The rule definition mentions index patterns `auditbeat-*` and `logs-endpoint.events.*`. I am only using `auditbeat-*`. Attaching screenshot of the error. ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/d/1df86204e2ab4a66d96be86a62b847dbba1889c8.png) Attaching error message. > An error occurred during rule execution: message: "verification\_exception: [verification\_exception] Reason: Found 1 problem line 4:5: first argument of [cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8")] must be [ip], found value [destination.ip] type [text]" name: "Connection to Internal Network via Telnet" id: "9f53abc6-2ce0-11ec-bf2a-a326ef99e497" rule id: "1b21abcc-4d9f-4b08-a7f5-316f5f94b973" signals index: ".siem-signals-default" Any help would be appreciated. Thanks. ---
**Author:** ![PD98](https://avatars.discourse-cdn.com/v4/letter/p/ea5d25/32.png) [@PD98](https://discuss.elastic.co/u/PD98)\ **Post date:** [October 22, 2021, 3:49am UTC](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981/2 "2021-10-22T03:49:17Z")
I am not able to figure this out. Any help would be appreciated. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 19, 2021, 3:49am UTC](https://discuss.elastic.co/t/rules-failing-due-to-field-mapping-errors/286981/3 "2021-11-19T03:49:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.