# SIEM doesn't show any Winlogbeat events, despite ES receiving them **URL:** \ **Category:** SIEM\ **Created:** [March 18, 2020, 12:21am UTC](https://discuss.elastic.co/t/siem-doesnt-show-any-winlogbeat-events-despite-es-receiving-them/224008 "2020-03-18T00:21:35Z")\ **Posts on this page:** 1\ **Showing post:** 10
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [April 10, 2020, 1:55pm UTC](https://discuss.elastic.co/t/siem-doesnt-show-any-winlogbeat-events-despite-es-receiving-them/224008/10 "2020-04-10T13:55:07Z")
@Aura, ahhh, I think I might see what's going on. I bet when you first setup winlog beat you accidentally forgot to push your templates which control the mapping? [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html) You can check your mapping in your dev tools: ![Screen Shot 2020-04-10 at 7.47.05 AM](https://us1.discourse-cdn.com/elastic/original/3X/4/9/491d7d95cfca5bbd7928e2db0c98c46eafde18fc.png) like so....To see the entire mapping of your winlog beats: ```auto GET winlogbeat-7.6.0/_mapping ``` ![Screen Shot 2020-04-10 at 7.48.30 AM](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6d8c61147c4ea14c45ba43ae4d555ce2841ecc94.png) If you want to just concentrate on the field in question which sounds like `host.name` it would be like so: ```auto GET winlogbeat-7.6.0/_mapping/field/host.name ``` ![Screen Shot 2020-04-10 at 7.50.25 AM](https://us1.discourse-cdn.com/elastic/original/3X/b/a/baf8d506836cc7596b3e7d269c8a452efb093aa3.png) You can see in my screen shot that `host.name` for my winlog beats is a keyword field. If for some reason it showed up as text field I would expect the error you have above showing up which indicates that you probably just need to overwrite your winlogbeat per that link above to fix things and then maybe do a reindex of existing data to change it from text to keyword fields. Which would make sense. Without an initial template/mapping loaded Elastic Search is going to auto-create your mapping and take guesses about things being text fields and keyword fields and then when our application tries to do an aggregation or sort you will see those errors showing up. --- _[View the full topic](https://discuss.elastic.co/t/siem-doesnt-show-any-winlogbeat-events-despite-es-receiving-them/224008)._