SIEM Signals not triggering

[Frank_Hassanabad]

Would it be possible to be able to post the two full JSON structures via a copy and paste? The full messages copy and pasted verbatim will help us determine how many issues are from the custom indexes all at once to reduce back and forth or any mistakes from re-typing.

I am assuming this is a custom mapping and not from one of the Elastic Agents/beats such as auditbeat.

However, from the first parts which are posted you do have what looks like timestamp instead of @timestamp:

{
  timestamp:{
    type: date
},

I would validate your mapping against the ECS standards from here:

elastic/ecs