Using "message" in custom alert rule

Elastic Security SIEM
1

I would like to create an alert that follows:

"message: some search string"

When I create the alert and save it. I receive the following error

"Bulk Indexing of signals failed: object mapping for [source] tried to parse field [source] as object, but found a concrete value,object mapping for [host]"

2

Looks like, you index fields are not properly mapped. On what data is the alert trying to query?

1 Like
3

@pcosic that is correct. I updated the version of filebeat. If anyone else runs into this issue they should note Breaking changes in 7.0 | Beats Platform Reference [7.13] | Elastic.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.