{
  "id": 17401832,
  "title": "Wazuh alert is in alerts.json but missing from the dashboard: mapper_parsing_exception",
  "url": "https://urgent.news/2026/10/31/wazuh-alert-is-in-alerts-json-but-missing-from-the-dashboard-mapper",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-31T12:41:41.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/xuxu298/wazuh-alert-is-in-alertsjson-but-missing-from-the-dashboard-mapperparsingexception-31of"
  },
  "original_language": "en",
  "account": "You open the dashboard but the alert is absent. You search alerts.json and the alert appears there. The manager appears healthy with no error messages. However, the indexer rejected the alert due to a mapper_parsing_exception. The issue lies in the Wazuh index template which maps many fields as keyword. The JSON decoder transforms the shape of the data differently based on the input. When a field path carries a different shape in the alert compared to the indexer, it results in a mapper_parsing_exception and the alert is not stored. This happens because each Filebeat writes its own log, sending alerts through an ingest pipeline into an index whose mapping comes from the Wazuh index template.",
  "summary": "You grep alerts.json and the alert is there. You open the dashboard and it is not. The manager looks healthy, the rule fired, and nothing in the UI says anything went wrong. The alert was rejected by the indexer. The manager only writes alerts.json. Filebeat then sends each alert through an ingest pipeline into an index whose mapping comes from the Wazuh index template, and the mapping allows one…",
  "key_points": [
    "Alert present in alerts.json but missing from dashboard",
    "Mapperparsingexception caused by Wazuh index template",
    "Issue stems from differing field shapes in JSON data"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}