# SIEM does not show data

**URL:** <https://discuss.elastic.co/t/siem-does-not-show-data/229010>\
**Category:** SIEM\
**Created:** [April 21, 2020, 9:47am UTC](https://discuss.elastic.co/t/siem-does-not-show-data/229010 "2020-04-21T09:47:32Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [April 22, 2020, 1:00pm UTC](https://discuss.elastic.co/t/siem-does-not-show-data/229010/5 "2020-04-22T13:00:29Z")

</div>

You didn't show me your mapping above? You just showed me a screen shot of where you tried to modify your mapping to turn on fielddata which is still not really recommended.

I think you wanted to show me from line 23 and below which would be:

```auto
GET filebeat-*/_mapping

```

However, if you have a direct connection from filebeat you can follow the commands from here:

[https://www.elastic.co/guide/en/beats/filebeat/current/command-line-options.html#setup-command](https://www.elastic.co/guide/en/beats/filebeat/current/command-line-options.html#setup-command)

to setup your templates such as:

```auto
filebeat setup

```

Then you should see that your have indexes, ILM policies, etc... setup

---

_[View the full topic](https://discuss.elastic.co/t/siem-does-not-show-data/229010)._