ELASTALERT ERROR document_parsing_exception

[securityfai]

Version

2.4.50

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

200

Storage for /nsm

200

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,

I have elasticagent installed on a windows machine, logs are parsed and displayed in hunt correctly, I created a Sigma rule in playbook to generate an alert if a desired Windows Event ID is detected.
I am unable to see the alert in the "alert" interface, when I verified elastalet.log I noticed that my rule is working and matched events but I got the error described below. Also, I tried my eql query in kibana console and I got successfully the matching events. what could be the problem Please?

[elasticsearch: request error 400 document_parsing_exception, [1:2066] failed to parse field [match_body.winlog.event_data.ProcessId] of type [long] in document with id 'jhbfguybhdjuyghfsju'. Preview of field's value: '0x23c']

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Looks like a mapping error with that field, The data type for that field in Elasticsearch is long and the the log has a different data type.