# Doc-Level Detector: Custom Rule Field Mappings Not Persisting After Creation
**URL:** https://forum.opensearch.org/t/doc-level-detector-custom-rule-field-mappings-not-persisting-after-creation/27498
**Category:** Security Analytics
**Tags:** discuss
**Created:** [November 18, 2025, 3:27pm UTC](https://forum.opensearch.org/t/doc-level-detector-custom-rule-field-mappings-not-persisting-after-creation/27498 "2025-11-18T15:27:57Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@sunil\_9944](https://forum.opensearch.org/u/sunil_9944)
#### Post date: [November 18, 2025, 3:27pm UTC](https://forum.opensearch.org/t/doc-level-detector-custom-rule-field-mappings-not-persisting-after-creation/27498/1 "2025-11-18T15:27:57Z")
Hi Team,
I am using **OpenSearch Security Analytics** and facing an issue where **field mappings appear during detector creation, but after saving the detector, the Field Mappings section becomes empty**.
### **What I Did**
1. Created a _Doc-level_ detector using the **Apache Access Log** log type.
2. During creation, OpenSearch automatically suggested correct mappings, e.g.:
```auto
Detection rule field: http.request.url
Data source field: http.request.url
```
1. The “Mapped fields” section correctly showed entries.
2. After clicking **Create Detector** , I opened the detector → **Field Mappings tab shows “No items found.”**
### **My Log Fields (from my index)**
Example log document:
```auto
client.ip: 192.168.1.100
event.created: 2025-11-18T20:37:00Z
host.hostname: test-nginx-server
http.request.method: GET
http.request.referrer: -
http.request.url: /index.php?id=1 UNION SELECT username,password FROM users
http.request.version: 1.1
http.response.body.bytes: 1234
http.response.status_code: 200
user_agent_original: Mozilla/5.0 <— Not ECS format
log_type: access
```
**Observations**
- The field mappings suggested during the creation step are **NOT stored in the detector JSON**.
- After saving the detector, `field_mappings` is empty.
- This happens even if only **1 field** (e.g., http.request.url) requires mapping.
- It seems that OpenSearch requires **full ECS compatibility for all rule-required fields** , and if even one field (like `user_agent_original`) doesn’t match ECS (`user_agent.original`), then **no mappings are persisted at all**.
### **Expected Behavior**
If I map one field manually, such as:
```auto
http.request.url → http.request.url
```
…then that mapping should persist, even if other optional ECS fields are missing.
### **Actual Behavior**
- Mapping shows during creation.
- Mapping disappears after saving the detector (UI shows “No items found”).
- The detector JSON contains `"field_mappings": []`.
### **Questions**
1. Is this the intended behavior for doc-level detectors?
(All-or-nothing ECS validation)
2. Can OpenSearch allow partial mappings to persist even if other rule fields are missing?
3. Is there a recommended approach for logs that are **ECS-like but not fully ECS compliant**?
### **Environment**
- OpenSearch 3.1.0
- Running inside Docker
- Log Type: **Apache Access**
- Index: `nginx_logs-*` (custom logs)
---
### Author:  [@Anthony](https://forum.opensearch.org/u/Anthony)
#### Post date: [December 2, 2025, 5:49pm UTC](https://forum.opensearch.org/t/doc-level-detector-custom-rule-field-mappings-not-persisting-after-creation/27498/2 "2025-12-02T17:49:56Z")
@sunil_9944 I am not able to see predefined fields in Apache Access logs, and the [documentation](https://docs.opensearch.org/latest/security-analytics/log-types-reference/apache-access/) confirmed this too. It would seem that currently you cannot make the Field mappings UI show rows for `apache_access` via the APIs, because the log type intentionally has no field mappings shipped. Your detector and rule still work, the pre-packaged `apache_access` rules use the raw fields (`verb`, `response`, etc.) directly,
You can use the following API to see the list available, empty properties is the reason for empty mappings:
```auto
GET _plugins/_security_analytics/mappings/view
{
"index_name": "apache_access_logs",
"rule_topic": "apache_access"
}
{
"properties": {},
"unmapped_index_fields": [
"verb",
"response",
"request",
"referrer",
"ident",
"httpversion",
"clientip",
"bytes",
"auth",
"agent",
"@timestamp"
]
}
```
You can compare this to window example:
```auto
GET _plugins/_security_analytics/mappings/view
{
"index_name": "windows",
"rule_topic": "windows"
}
{
"properties": {
"process.command_line": {
"path": "CommandLine",
"type": "alias"
},
"winlog.event_id": {
"path": "EventID",
"type": "alias"
},
"winlog.user.name": {
"path": "User",
"type": "alias"
}
},
"unmapped_index_fields": [
"@timestamp"
],
"unmapped_field_aliases": [
"winlog.event_data.AuthenticationPackageName",
"winlog.event_data.ScriptBlockLogging",
"winlog.event_data.SidHistory",
"winlog.event_data.Properties",
...
```
---
### Author:  [@system](https://forum.opensearch.org/u/system)
#### Post date: [January 31, 2026, 5:50pm UTC](https://forum.opensearch.org/t/doc-level-detector-custom-rule-field-mappings-not-persisting-after-creation/27498/3 "2026-01-31T17:50:53Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.