# Mapping API / index pattern

**URL:** <https://forum.opensearch.org/t/mapping-api-index-pattern/13651>\
**Category:** Security Analytics\
**Created:** [March 27, 2023, 5:53pm UTC](https://forum.opensearch.org/t/mapping-api-index-pattern/13651 "2023-03-27T17:53:54Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![orazaly1508](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/orazaly1508/32/5058_2.png) [@orazaly1508](https://forum.opensearch.org/u/orazaly1508)\
**Post date:** [March 28, 2023, 4:37am UTC](https://forum.opensearch.org/t/mapping-api-index-pattern/13651/3 "2023-03-28T04:37:12Z")

</div>

Yes, mapping APIs support data streams and index patterns. However, the endpoint you are using to create mappings, **`/_plugins/_security_analytics/mappings`** , is specific to the OpenSearch Security Analytics plugin and may not work with data streams. Additionally, you should use the POST method instead of PUT.

Here’s an example of how you can create a mapping using the correct endpoint and method:

```bash
POST /_plugins/_security_analytics/mapping
{
  "index_name": "ntd.hunt-dns",
  "mappings": {
    "properties": {
      "dns-response-code": {
        "type": "alias",
        "path": "dns.response.code"
      }
    }
  }
}

```

This endpoint supports datastreams, so you can use it with datastream names as well.

---

_[View the full topic](https://forum.opensearch.org/t/mapping-api-index-pattern/13651)._