# Create detectors on datastream

**URL:** <https://forum.opensearch.org/t/create-detectors-on-datastream/16997>\
**Category:** Security Analytics\
**Created:** [December 8, 2023, 10:02am UTC](https://forum.opensearch.org/t/create-detectors-on-datastream/16997 "2023-12-08T10:02:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Enyce](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@Enyce](https://forum.opensearch.org/u/Enyce)\
**Post date:** [December 8, 2023, 10:02am UTC](https://forum.opensearch.org/t/create-detectors-on-datastream/16997/1 "2023-12-08T10:02:26Z")

</div>

Anyone ever succed to create a detectors on a datastream ?

While putting the ‘.ds-winlogbeat-\*’ index pattern, it triggers an error with:

```auto
[security_analytics_exception] null cannot be cast to non-null type kotlin.collections.MutableMap<kotlin.String, kotlin.Any>

```

---

<div class="post-metadata">

**Author:** ![adn77](https://avatars.discourse-cdn.com/v4/letter/a/dc4da7/32.png) [@adn77](https://forum.opensearch.org/u/adn77)\
**Post date:** [December 8, 2023, 9:23pm UTC](https://forum.opensearch.org/t/create-detectors-on-datastream/16997/2 "2023-12-08T21:23:16Z")

</div>

I just use `winlogbeat` as the index name. The data stream name is basically an alias for a bunch of indices.

---

<div class="post-metadata">

**Author:** ![Enyce](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@Enyce](https://forum.opensearch.org/u/Enyce)\
**Post date:** [December 9, 2023, 7:16pm UTC](https://forum.opensearch.org/t/create-detectors-on-datastream/16997/3 "2023-12-09T19:16:40Z")

</div>

putting my datasteam alias index gives me:

```auto
[2023-12-09T19:31:53,582][ERROR][o.o.a.t.TransportIndexMonitorAction] [prd-siem-clusrer-node-1] failed to index doc level queries monitor w7sQUIwBTJLvaV9jlY-1. deleting monitor

```

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/9b8b391fba49a63fa6e24588356478b2e85c2e06.png)

---

<div class="post-metadata">

**Author:** ![Enyce](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@Enyce](https://forum.opensearch.org/u/Enyce)\
**Post date:** [December 16, 2023, 6:39pm UTC](https://forum.opensearch.org/t/create-detectors-on-datastream/16997/4 "2023-12-16T18:39:54Z")

</div>

Up

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [February 14, 2024, 6:40pm UTC](https://forum.opensearch.org/t/create-detectors-on-datastream/16997/5 "2024-02-14T18:40:37Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.