# The following indices are missing the timestamp override field "event.ingested":

**URL:** <https://discuss.elastic.co/t/the-following-indices-are-missing-the-timestamp-override-field-event-ingested/306439>\
**Category:** Elastic Security\
**Created:** [June 6, 2022, 11:04am UTC](https://discuss.elastic.co/t/the-following-indices-are-missing-the-timestamp-override-field-event-ingested/306439 "2022-06-06T11:04:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![anushka1203](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anushka1203/32/98018_2.png) [@anushka1203](https://discuss.elastic.co/u/anushka1203)\
**Post date:** [June 6, 2022, 11:04am UTC](https://discuss.elastic.co/t/the-following-indices-are-missing-the-timestamp-override-field-event-ingested/306439/1 "2022-06-06T11:04:25Z")

</div>

Hi,

I have duplicated the "Potential Disabling of SELinux" rule, exported it and imported it again to add my custom index pattern (selinux\_index) by editing the NDJSON file. However I am getting the following warning and nothing is getting detected-

```auto
The following indices are missing the timestamp override field "event.ingested": ["selinux_index"]

```

How can I solve this issue?  
Thanks in advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 4, 2022, 11:05am UTC](https://discuss.elastic.co/t/the-following-indices-are-missing-the-timestamp-override-field-event-ingested/306439/2 "2022-07-04T11:05:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.