Rules in ElasticSIEM not create signals

[Nazarenko (WJ)]

Using https://discuss.elastic.co/t/bulkresponse-had-errors-with-response-statuses-counts-of/226492 i made this. Afther that i see that i have problem with fieds in my index:

I changed host field name using logstash, and is workig!