# SIEM doesn't show any Winlogbeat events, despite ES receiving them **URL:** \ **Category:** SIEM\ **Created:** [March 18, 2020, 12:21am UTC](https://discuss.elastic.co/t/siem-doesnt-show-any-winlogbeat-events-despite-es-receiving-them/224008 "2020-03-18T00:21:35Z")\ **Posts on this page:** 1\ **Showing post:** 9
**Author:** ![Mike\_Paquette](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_paquette/32/119011_2.png) [@Mike\_Paquette](https://discuss.elastic.co/u/Mike_Paquette)\ **Post date:** [April 9, 2020, 11:34am UTC](https://discuss.elastic.co/t/siem-doesnt-show-any-winlogbeat-events-despite-es-receiving-them/224008/9 "2020-04-09T11:34:35Z")
Hi @aura, as you've discovered, it seems that some of your fields are not being mapped to the correct Elasticsearch [datatypes](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/mapping-types.html). Elastic Common Schema (ECS) specifies that fields such as `host.name` must be of the [keyword](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/keyword.html) datatype. Indeed, as you've also discovered, Elastic SIEM relies specifically on `host.name` to be present as a condition for populating many visualizations with host data. I'm not sure how familiar you are with Elasticsearch [mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html) and [index templates](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/indices-templates.html), as they can be challenging. The ECS GitHub repository provides an example template [here](https://github.com/elastic/ecs/blob/1.5/generated/elasticsearch/7/template.json). FYI, we've been pulling together some additional notes about ECS fields required to use Elastic SIEM. We hope these might be helpful as you add additional data sources to your SIEM. #### Notes for Elastic SIEM users The Elastic SIEM app queries, filters, aggregates, and/or displays a growing list of ECS fields. For an optimal experience with Elastic SIEM, and to reduce time spent on updating your ingestion pipelines in the future, please follow the [Converting your data to ECS](https://github.com/MikePaquette/ecs-1/blob/update-converting-doc/docs/converting.asciidoc#ecs-conv) instructions, populating as many ECS fields as practical, paying particular attention to: - Ensure that your network events populate ECS `source` and `destination` fields. Network events may not be displayed in the SIEM app network views if `source.ip` and `destination.ip` fields are not populated. - If you have network protocol events, be sure to populate the `http` , `dns` , and `tls` field sets. - Ensure that your host events populate ECS `host` fields. Host events will not be displayed in the SIEM app host views if the `host.name` field is not populated. Recall that `host.name` should be populated with the name of the host where the event happened, not the name of a collector or observer. - If your host events contain details about process activity, ensure that your fields are mapped to the corresponding ECS `process` fields. - Be sure that for all your events, you populate the ECS categorization fields: `event.kind` , `event.category` , `event.type` , and `event.outcome` . SIEM authentication and process widgets depend on these fields being populated. Also, try to populate the ECS `event.action` field with relevant details for your event. --- _[View the full topic](https://discuss.elastic.co/t/siem-doesnt-show-any-winlogbeat-events-despite-es-receiving-them/224008)._