title: Elasticsearch SIEM is not working, but EQL query is ok
body: <p>I got some problems with my ELK running on docker.
  I made ssl on tls and http and tryied to make simple EQL-query:</p>
  <pre><code>sequence by winlog.computer_name 
  [iam where event.code == &quot;4720&quot;] 
  [iam where event.code == &quot;4726&quot;]
  </code></pre>
  <p>When i click on show results i see hits <a href="https://i.stack.imgur.com/0tUxP.png" rel="nofollow noreferrer">preview of results</a></p>
  <p>but when i'm trying to reproduce alert it's zero hits in index</p>
  <blockquote>
  <p>.siem-signals-default-*</p>
  </blockquote>
  <p>I got some warns from my elasticsearch-container:</p>
  <blockquote>
  <p>{&quot;type&quot;: &quot;server&quot;, &quot;timestamp&quot;: &quot;2021-10-25T12:37:33,433Z&quot;, &quot;level&quot;: &quot;WARN&quot;, &quot;component&quot;: &quot;o.e.x.s.t.n.SecurityNetty4HttpServerTransport&quot;, &quot;cluster.name&quot;: &quot;elastdocker-cluster&quot;, &quot;node.name&quot;: &quot;elastdocker-node-0&quot;, &quot;message&quot;: &quot;received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/172.20.0.5:9200, remoteAddress=/172.20.0.2:43450}&quot;, &quot;cluster.uuid&quot;: &quot;oZsivcyzROWSooXVIPzbKQ&quot;, &quot;node.id&quot;: &quot;KIjWJ0OjSW-lYt51cO8ViQ&quot;  }</p>
  </blockquote>
  <p>Where is the problem? Any ideas?</p>