Wazuh alert is in alerts.json but missing from the dashboard: mapper_parsing_exception
You grep alerts.json and the alert is there. You open the dashboard and it is not. The manager looks healthy, the rule fired, and nothing in the UI says anything went wrong. The alert was rejected by the indexer. The manager only writes alerts.json. Filebeat then sends each alert through an ingest pipeline into an index whose mapping comes from the Wazuh index template, and the mapping allows one…
You open the dashboard but the alert is absent. You search alerts.json and the alert appears there. The manager appears healthy with no error messages. However, the indexer rejected the alert due to a mapper_parsing_exception. The issue lies in the Wazuh index template which maps many fields as keyword. The JSON decoder transforms the shape of the data differently based on the input.
When a field path carries a different shape in the alert compared to the indexer, it results in a mapper_parsing_exception and the alert is not stored. This happens because each Filebeat writes its own log, sending alerts through an ingest pipeline into an index whose mapping comes from the Wazuh index template.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
