No cached mapping warning on data.office365.SystemOverrides

Rahul Manoj

unread,

Jun 25, 2026, 1:37:54 AMJun 25

to Wazuh | Mailing List

Hi all,

I'm seeing a "No cached mapping for this field" warning in Discover on data.office365.SystemOverrides (screenshots attached, x2 — same warning shown consistently).

Environment: Wazuh 4.14.5, OpenSearch Dashboards, Office365 module, AWS module

What I've checked:

Refreshing the index pattern field list doesn't clear it.
Checked archives.log directly — the field is empty for the events I inspected, not just empty in the UI.

No other office365 fields are affected, just this one.

Can someone confirm this is expected, or let me know if there's a template fix I should be applying?

Thank you

Md. Nazmur Sakib

unread,

Jun 25, 2026, 1:44:50 AMJun 25

to Wazuh | Mailing List

Hi Rahul,

Go to Dashboard management > Dashboards Management > Index patterns

And select wazuh-alerts-* template.

And click on the refresh icon. Similar to the screenshot.

2026-01-22 10 44 42.png

If you have multiple wazuh-alerts index templates, please refresh the other one as well.

2026-01-22 10 42 51.png

Now, reload the Wazuh dashboard webpage, go to your alerts on Discover and check if these fields are searchable or not.

Looking forward to your update.

Rahul Manoj

unread,

Jun 25, 2026, 2:07:25 AMJun 25

to Wazuh | Mailing List

Hi,

i had already tried refreshing the index pattern but the issue still persists in GUI.
i had checked refreshing again and verified.

Thank you

Md. Nazmur Sakib

unread,

Jun 25, 2026, 2:28:04 AMJun 25

to Wazuh | Mailing List

Restart the indexer service.

systemctl daemon-reload
systemctl restart wazuh-indexer

In the Wazuh dashboard, click on the hamburger icon at the top left > Index Management > Dev Tools. Please run and share the outputs of the following commands:
GET wazuh-alerts-*/_mapping/field/<affectedfield>

Where <affectedfield> is the field that is not populated with data.

From the Index Management > Dev Tools. Please run and check the outputs of the following commands:

GET wazuh-alerts-*/_settings

It will show you the field's limit.
"mapping": {

"total_fields": {

"limit": "10000"

}

Next, go to Dashboard management > Dashboards Management > Index patterns

And select wazuh-alerts-* template.

Check how many fields you have currently on that index pattern.
2026-01-26 14 42 59.png

If you have hit the index limit. You can use this to increase the index field limit.

Index Management > Dev Tools.

PUT wazuh-alerts-*/_settings

{

"index.mapping.total_fields.limit": 20000

}

Also for the future indices.
Go to vi /etc/filebeat/wazuh-template.json

Change the total_fields.limit
"index.mapping.total_fields.limit": 20000,

And load the configuration

filebeat setup --pipelines

filebeat setup --index-management -E output.logstash.enabled=false

Restart Filebeat:

systemctl restart filebeat

Now reindex today's index.

Create a backup of the data with this command.

POST _reindex

{

"source": {

"index": "wazuh-alerts-4.x-2026.06.25"

},

"dest": {

"index": "wazuh-alerts-4.x-backup"

}

Delete your data index

DELETE /wazuh-alerts-4.x-2026.06.25

Recreate the data index from the backup

POST _reindex

{

"source": {

"index": "wazuh-alerts-4.x-backup"

},

"dest": {

"index": "wazuh-alerts-4.x-2026.06.25"

}

Delete the backup index

DELETE /wazuh-alerts-4.x-backup

Now, go to the indexer pattern, click on the refresh button as I instructed before.

After that, go to the Discover or Threat Hunting page and filter today and check if you are able to see the fields in searchable format in today's index.

Let me know the update on this.

Rahul Manoj

unread,

Jun 25, 2026, 2:38:06 AMJun 25

to Wazuh | Mailing List

Hi i have not hit the index limit.
the limit is shown as:

"mapping": {
"total_fields": {
"limit": "10000"
}
},

the number of indices shown in dashboard management > index pattern is 2469.

Rahul Manoj

unread,

Jun 25, 2026, 8:27:18 AMJun 25

to Wazuh | Mailing List

Hi,
can you confirm if fields with data will only get refreshed or without data will also get refreshed?

Md. Nazmur Sakib

unread,

Jun 30, 2026, 1:22:57 AMJun 30

to Wazuh | Mailing List

Sorry for the delay in the follow-up. Fields with or without data can both get indexed.

Check this screenshot for reference.
2026-06-30 11 20 19.png

Are you still facing the issue with fields not getting indexed?
If yes, go to

Index Management > Dev Tools. Please run and share the outputs of the following commands:
GET wazuh-alerts-*/_mapping/field/<affectedfield>

Where <affectedfield> is the field that is not populated with data.

This will help us understand if the filed as any mapping in the index pattern.

Rahul Manoj

unread,

Jul 2, 2026, 7:59:49 AMJul 2

to Wazuh | Mailing List

hi,

sorry for the delay.

the output for the command GET wazuh-alerts-*/_mapping/field/data.office365.SystemOverrides

{
"wazuh-alerts-4.x-2026.05.19": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.25": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.24": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.23": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.22": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.29": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.07.02": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.28": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.27": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.26": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.07.01": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.21": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.20": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.30": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.14": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.26": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.25": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.24": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.23": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.18": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.29": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.17": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.16": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.28": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.27": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.15": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.22": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.21": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.20": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.09": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.15": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.02": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.14": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.01": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.13": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.12": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.19": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.18": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.17": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.16": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.11": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.10": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.04": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.03": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.02": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.01": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.08": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.07": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.06": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.06.05": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.31": {
"mappings": {}
},
"wazuh-alerts-4.x-2026.05.30": {
"mappings": {}
}
}

Md. Nazmur Sakib

unread,

Jul 3, 2026, 2:16:14 AMJul 3

to Wazuh | Mailing List

Your command result confirms that, that confirms that this field is not mapped on the index pattern.

Edit /etc/filebeat/wazuh-template.json

Add SystemOverrides (as keyword) under the data.office365 properties block, then

Ex:

"office365": {

"properties": {

"Actor": {

"properties": {

"ID": {

"type": "keyword"

}

},

"UserId": {

"type": "keyword"

},

"Operation": {

"type": "keyword"

},

"ClientIP": {

"type": "keyword"

},

"ResultStatus": {

"type": "keyword"

},
"SystemOverrides": {

"type": "keyword"

},

"Subscription": {

"type": "keyword"

}

},

"github": {

Now load the configuration and restart the filebeat.

sudo filebeat setup -index-management

sudo systemctl restart filebeat

After that, reindex today's index.

Go to Indexer Management > Dev Tools

Make a backup index.

POST _reindex

{

"source": {

"index": "wazuh-alerts-4.x-2026.07.03"

},

"dest": {

"index": "wazuh-alerts-4.x-backup"

}

Delete the main index

DELETE /wazuh-alerts-4.x-2026.07.03

Create the main index from the backup

POST _reindex

{

"source": {

"index": "wazuh-alerts-4.x-backup"

},

"dest": {

"index": "wazuh-alerts-4.x-2026.07.03"

}

Delete the backup index

DELETE /wazuh-alerts-4.x-backup

Now try to generate a new alert, which has this field.

data.office365.SystemOverrides

Go to Dashboard management > Dashboards Management > Index patterns

And select wazuh-alerts-* template.

And click on the refresh icon.

Now check the field on the Discover or Threat Hunting page and let me know if this resolves the issue.

Rahul Manoj

unread,

Jul 20, 2026, 1:26:51 AM (yesterday) Jul 20

to Wazuh | Mailing List

Hi,

I'm running into the same "no cached mapping" issue on several other fields as well, not just this one (eg: aws as well). Manually adding each field to wazuh-template.json and reindexing every time a new one comes up doesn't seem sustainable long-term, especially since the O365/MS Graph schema keeps evolving.

Is editing the template field-by-field really the only way to handle this, or is there a way to map data.office365.* (or similar module fields) more broadly?
Also, noticed some of these fields show up empty even in archives.log

Thanks & Regards,

Rahul

Md. Nazmur Sakib

unread,

Jul 20, 2026, 2:41:34 AM (yesterday) Jul 20

to Wazuh | Mailing List

Check the /etc/filebeat/wazuh-template.json file.

Make sure that under the dynamic_templates there's no configuration like "dynamic": false / "dynamic": "strict"

The configuration should look like this.
"mappings": {

"dynamic_templates": [

{

"string_as_keyword": {

"mapping": {

"type": "keyword"

},

"match_mapping_type": "string"

}

],

This tells the index: whenever a new, unmapped field shows up and its value is a string, automatically map it as keyword (exact-match, aggregatable) instead of the default text.

In other words, it's the catch-all rule that lets new O365/AWS/MS Graph fields get mapped on their own, no manual template edits needed.

If you make any changes to the configuration, load the configuration and restart Filebeat.

sudo filebeat setup -index-management

sudo systemctl restart filebeat

If you still face issues, please share the /etc/filebeat/wazuh-template.json file so that I can review it from my end.

Rahul Manoj

unread,

1:09 AM (14 hours ago) 1:09 AM

to Wazuh | Mailing List

Hi,

i checked in wazuh_templates.json and verified the dynamic mapping section and its the same as the one mentioned in your response.

I have attached the json file for your review.

Looking forward to your response.