# Visualizations has errors default page **URL:** \ **Category:** SIEM\ **Created:** [August 17, 2020, 4:22am UTC](https://discuss.elastic.co/t/visualizations-has-errors-default-page/245176 "2020-08-17T04:22:29Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![bevano](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@bevano](https://discuss.elastic.co/u/bevano)\ **Post date:** [August 17, 2020, 4:22am UTC](https://discuss.elastic.co/t/visualizations-has-errors-default-page/245176/1 "2020-08-17T04:22:29Z")
Hi All, Just started to play around with SIEM. When opening the menu, we are constantly presented with this error. The only logs we are ingesting is our building security logs, and I have manually created logstash filters for this. All events are tied to fields founds in the ECS. Is there a way we resolve these errors? ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e66ca560b2650b7e82b690660619b9887db1845.png) ---
**Author:** ![stephmilovic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephmilovic/32/146835_2.png) [@stephmilovic](https://discuss.elastic.co/u/stephmilovic)\ **Post date:** [August 17, 2020, 2:02pm UTC](https://discuss.elastic.co/t/visualizations-has-errors-default-page/245176/2 "2020-08-17T14:02:01Z")
Hi @bevano, thanks for posting. It looks like one of your fields is mapped as text and it needs to be mapped as a keyword in order to aggregate in ES. Could you please post the mapping of your index and we can take a look at what field it might be? ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [August 17, 2020, 7:35pm UTC](https://discuss.elastic.co/t/visualizations-has-errors-default-page/245176/3 "2020-08-17T19:35:26Z")
Yeah this often happens if you haven't pushed your index templates and you can see us answering this here with some pointers on what to do: > [@SIEM doesn't show any Winlogbeat events, despite ES receiving them](https://discuss.elastic.co/t/siem-doesnt-show-any-winlogbeat-events-despite-es-receiving-them/224008/10): > > @Aura, ahhh, I think I might see what's going on. I bet when you first setup winlog beat you accidentally forgot to push your templates which control the mapping? [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html) You can check your mapping in your dev tools: [Screen Shot 2020-04-10 at 7.47.05 AM] like so....To see the entire mapping of your winlog beats: GET winlogbeat-7.6.0/\_mapping If you want to just concentrate on… I don't know if it's your winlogbeat, audtibeat, some custom one, etc... but usually if you can get your templates and ECS mapping pushed up and then do a reindex, data reset, you will be ok. ---
**Author:** ![bevano](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@bevano](https://discuss.elastic.co/u/bevano)\ **Post date:** [August 18, 2020, 12:38am UTC](https://discuss.elastic.co/t/visualizations-has-errors-default-page/245176/4 "2020-08-18T00:38:43Z")
Thanks @stephmilovic and @Frank_Hassanabad for the reply. And yes, i haven't pointed it to a template since I was just playing around. After re-reading this [https://www.elastic.co/guide/en/ecs/current/index.html](https://www.elastic.co/guide/en/ecs/current/index.html) under hosts, i can see the type for each of the fields. I assume if I follow those types in the guide i should be fine? ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [August 18, 2020, 2:05am UTC](https://discuss.elastic.co/t/visualizations-has-errors-default-page/245176/5 "2020-08-18T02:05:11Z")
Depends on what you're doing. If you're writing your own downstream agent/beat/script that is going to parse logs and push it as ECS you can use existing tools from the ECS repo here: > **[elastic/ecs](https://github.com/elastic/ecs)** > > Elastic Common Schema. Contribute to elastic/ecs development by creating an account on GitHub. and from their tooling guide: > If you want to start without using the tooling you can just push in a mapping you customize using the dev tooling of Kibana from the ECS generated template here: > If you're playing around with beats such as auditbeat, metricbeat, etc... you can do a setup and run one of the beats and then look at the mappings and ILM index lifecycle management (ILM) policies they have as good examples as well. Those things will probably save you a lot of time. Have fun and let us know how it goes! ---
**Author:** ![bevano](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@bevano](https://discuss.elastic.co/u/bevano)\ **Post date:** [August 18, 2020, 2:09am UTC](https://discuss.elastic.co/t/visualizations-has-errors-default-page/245176/6 "2020-08-18T02:09:39Z")
Perfect. Majority of it will be done using the existing beats/agent modules but there are some custom stuff that we need ingested. Thank you very much for the info. Much appreciated ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 15, 2020, 2:09am UTC](https://discuss.elastic.co/t/visualizations-has-errors-default-page/245176/7 "2020-09-15T02:09:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.