diff --git a/x-pack/legacy/plugins/siem/server/utils/beat_schema/index.test.ts b/x-pack/legacy/plugins/siem/server/utils/beat_schema/index.test.ts
index 2be7724f4097f..53ed7c26b877f 100644
--- a/x-pack/legacy/plugins/siem/server/utils/beat_schema/index.test.ts
+++ b/x-pack/legacy/plugins/siem/server/utils/beat_schema/index.test.ts
@@ -6,7 +6,7 @@
 
 import { cloneDeep, isArray } from 'lodash/fp';
 
-import { convertSchemaToAssociativeArray, getIndexSchemaDoc } from '.';
+import { convertSchemaToAssociativeArray, getIndexSchemaDoc, getIndexAlias } from '.';
 import { auditbeatSchema, filebeatSchema, packetbeatSchema } from './8.0.0';
 import { Schema } from './type';
 
@@ -657,4 +657,17 @@ describe('Schema Beat', () => {
       ]);
     });
   });
+
+  describe('getIndexAlias', () => {
+    test('getIndexAlias handles values with leading wildcard', () => {
+      const leadingWildcardIndex = '*-auditbeat-*';
+      const result = getIndexAlias([leadingWildcardIndex], leadingWildcardIndex);
+      expect(result).toBe(leadingWildcardIndex);
+    });
+    test('getIndexAlias no match returns "unknown" string', () => {
+      const index = 'auditbeat-*';
+      const result = getIndexAlias([index], 'hello');
+      expect(result).toBe('unknown');
+    });
+  });
 });
diff --git a/x-pack/legacy/plugins/siem/server/utils/beat_schema/index.ts b/x-pack/legacy/plugins/siem/server/utils/beat_schema/index.ts
index aaa171c6befd9..a191bd835a7c7 100644
--- a/x-pack/legacy/plugins/siem/server/utils/beat_schema/index.ts
+++ b/x-pack/legacy/plugins/siem/server/utils/beat_schema/index.ts
@@ -77,7 +77,7 @@ const convertFieldsToAssociativeArray = (
     : {};
 
 export const getIndexAlias = (defaultIndex: string[], indexName: string): string => {
-  const found = defaultIndex.find(index => indexName.match(index) != null);
+  const found = defaultIndex.find(index => `\\${indexName}`.match(`\\${index}`) != null);
   if (found != null) {
     return found;
   } else {