Wazuh alerts dropped from dashboard by indexer mapping conflict (mapper_parsing_exception)

An alert can appear in alerts.json on the Wazuh manager yet be missing from the dashboard because the indexer rejects it. Filebeat sends alerts through an ingest pipeline into an index whose mapping allows only one type per field path, and the stock template maps many data fields as keyword. When an event carries an object or list at such a path, the indexer returns mapper_parsing_exception and silently discards the document. The article shows how to check a field's mapping through the indexer API and compare it with the alert's data shape. It reports that Microsoft Graph sign-in events send status and policy fields as objects, causing rejections while alerts and incidents send status as a string.