# Rules in ElasticSIEM not create signals **URL:** \ **Category:** SIEM\ **Created:** [April 15, 2020, 9:34am UTC](https://discuss.elastic.co/t/rules-in-elasticsiem-not-create-signals/228068 "2020-04-15T09:34:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Nazarenko](https://avatars.discourse-cdn.com/v4/letter/n/b38774/32.png) [@Nazarenko](https://discuss.elastic.co/u/Nazarenko)\ **Post date:** [April 15, 2020, 9:34am UTC](https://discuss.elastic.co/t/rules-in-elasticsiem-not-create-signals/228068/1 "2020-04-15T09:34:18Z")
Hello, i have some problem with rules in ElasticSIEM. I have a lot of indexies but in on of them rules don't working. Messages about error rules are absent. WIth one index rule are working but when i write rule for other index it no workig. ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [April 15, 2020, 11:39am UTC](https://discuss.elastic.co/t/rules-in-elasticsiem-not-create-signals/228068/2 "2020-04-15T11:39:12Z")
Hi, can you give us some details, please? What are the indices on which it doesn't work named. Perhaps a screenshot of the Rule configuration would also be useful. ---
**Author:** ![Nazarenko](https://avatars.discourse-cdn.com/v4/letter/n/b38774/32.png) [@Nazarenko](https://discuss.elastic.co/u/Nazarenko)\ **Post date:** [April 15, 2020, 1:53pm UTC](https://discuss.elastic.co/t/rules-in-elasticsiem-not-create-signals/228068/3 "2020-04-15T13:53:54Z")
Thank you for the quick reply. It's a log about rule working. ![Снимок экрана от 2020-04-15 16-58-08](https://us1.discourse-cdn.com/elastic/original/3X/e/3/e35387db0414498e2d69d4d75d3bac0832bd36df.png) Rule: ![psssss03-01](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a01b6fdfbe2e5a4217eeaacf786af4abbf660d2b.jpeg) ---
**Author:** ![Nazarenko](https://avatars.discourse-cdn.com/v4/letter/n/b38774/32.png) [@Nazarenko](https://discuss.elastic.co/u/Nazarenko)\ **Post date:** [April 16, 2020, 8:35am UTC](https://discuss.elastic.co/t/rules-in-elasticsiem-not-create-signals/228068/4 "2020-04-16T08:35:31Z")
Using [https://discuss.elastic.co/t/bulkresponse-had-errors-with-response-statuses-counts-of/226492](https://discuss.elastic.co/t/bulkresponse-had-errors-with-response-statuses-counts-of/226492) i made this. Afther that i see that i have problem with fieds in my index: ![Снимок экрана от 2020-04-16 11-27-04](https://us1.discourse-cdn.com/elastic/original/3X/3/1/31be43b4df3a8469c6aa43eabda6c27604a12799.png) I changed host field name using logstash, and is workig! 😀 ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [April 16, 2020, 2:23pm UTC](https://discuss.elastic.co/t/rules-in-elasticsiem-not-create-signals/228068/5 "2020-04-16T14:23:48Z")
Thank you for getting back to us @Nazarenko and letting us know what the issue was. We have recently changed that error reporting for the log files for the backend here: > And that will be part of a release starting in 7.8.0 moving forward. Glad to see we have a concrete use case for testing out error reporting for when we push signals into the backend at this point. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 14, 2020, 2:23pm UTC](https://discuss.elastic.co/t/rules-in-elasticsiem-not-create-signals/228068/6 "2020-05-14T14:23:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.