# Yet Another Elastic SIEM Not Showing Hosts

**URL:** <https://discuss.elastic.co/t/yet-another-elastic-siem-not-showing-hosts/241332>\
**Category:** SIEM\
**Created:** [July 15, 2020, 4:14pm UTC](https://discuss.elastic.co/t/yet-another-elastic-siem-not-showing-hosts/241332 "2020-07-15T16:14:13Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [July 20, 2020, 7:49pm UTC](https://discuss.elastic.co/t/yet-another-elastic-siem-not-showing-hosts/241332/9 "2020-07-20T19:49:21Z")

</div>

This sounds similar to this issue here maybe?

> [@SIEM doesn't show any Winlogbeat events, despite ES receiving them](https://discuss.elastic.co/t/siem-doesnt-show-any-winlogbeat-events-despite-es-receiving-them/224008/10):
>
> @Aura, ahhh, I think I might see what's going on. I bet when you first setup winlog beat you accidentally forgot to push your templates which control the mapping? [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html) You can check your mapping in your dev tools: [Screen Shot 2020-04-10 at 7.47.05 AM] like so....To see the entire mapping of your winlog beats: GET winlogbeat-7.6.0/\_mapping If you want to just concentrate on…

You can use those instructions to check your mappings. What can happen is if you have a beat that is constantly pushing data and don't shut it down before re-doing your mappings, that beat will still usually "win" by pushing a new piece of data into the system and then you get default dynamic mappings all over again which are going to mostly text fields which is not what we want.

When re-doing mappings you have to:

- ensure everything is shut down and nothing gets back in
- Remove your mappings
- Push your explicit beats mappings
- Turn on your beats again
- Check your mappings one more time to make sure the right parts are still keyword and not textfield

---

_[View the full topic](https://discuss.elastic.co/t/yet-another-elastic-siem-not-showing-hosts/241332)._
