# SIEM error new install **URL:** \ **Category:** SIEM\ **Created:** [July 1, 2020, 1:43am UTC](https://discuss.elastic.co/t/siem-error-new-install/239387 "2020-07-01T01:43:06Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jclemons7](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jclemons7/32/20655_2.png) [@jclemons7](https://discuss.elastic.co/u/jclemons7)\ **Post date:** [July 1, 2020, 1:43am UTC](https://discuss.elastic.co/t/siem-error-new-install/239387/1 "2020-07-01T01:43:06Z")
Hello, I have a filebeat from one ubuntu 20.04 and netflow going to my stack directly into elasticsearch. The stack is one server and it's running native (not in docker or anything) running 7.8. Whenever I try to open the SIEM app I get the following error. `[illegal_argument_exception] Text fields are not optimised for operations that require per-document field data like aggregations and sorting, so these operations are disabled by default. Please use a keyword field instead. Alternatively, set fielddata=true on [event.dataset] in order to load field data by uninverting the inverted index. Note that this can use significant memory.` Any tips or tricks to get the SIEM app to work? ---
**Author:** ![RylandHerrick](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rylandherrick/32/67401_2.png) [@RylandHerrick](https://discuss.elastic.co/u/RylandHerrick)\ **Post date:** [July 1, 2020, 3:33am UTC](https://discuss.elastic.co/t/siem-error-new-install/239387/2 "2020-07-01T03:33:09Z")
Hi @jclemons7, welcome back to the forum! Your error indicates that `event.dataset` is being mapped to a `text` field instead of a `keyword` field. Since the filebeat index template maps `event.dataset` to `keyword`, it's possible that you did not [load the index template](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html) as part of your filebeat setup. If that's the issue, follow those instructions and you should be on your way! If not, sharing [your mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html) and the details of your setup will help further narrow the issue. -- Ryland ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 29, 2020, 3:33am UTC](https://discuss.elastic.co/t/siem-error-new-install/239387/3 "2020-07-29T03:33:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.