Yeah this often happens if you haven't pushed your index templates and you can see us answering this here with some pointers on what to do:
I don't know if it's your winlogbeat, audtibeat, some custom one, etc... but usually if you can get your templates and ECS mapping pushed up and then do a reindex, data reset, you will be ok.