<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">I got this working. It seems that the Elastic output was not configured as i wish.</div><div class="">Now i created my own output template and that should work ;)</div><div class=""><br class=""></div><div class="">Just the „action Block“ is missing in my index.</div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">Am 18.06.2016 um 14:15 schrieb Daniel Eschner <<a href="mailto:daniel@linux-nerd.de" class="">daniel@linux-nerd.de</a>>:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">Am 18.06.2016 um 12:46 schrieb Eric Leblond <<a href="mailto:eric@regit.org" class="">eric@regit.org</a>>:</div><br class="Apple-interchange-newline"><div class=""><p dir="ltr" class="">Hi,<br class="">
Le 18 juin 2016 11:07 AM, Daniel Eschner <<a href="mailto:daniel@linux-nerd.de" class="">daniel@linux-nerd.de</a>> a écrit :<br class="">
><br class="">
> Hi there,<br class="">
><br class="">
> i run Suricata on a pfSense. I Try to build some Dashboards. For the First everthing seems running but it seems i have Problems with domains like <a href="http://linux-nerd.de/" class="">linux-nerd.de</a><br class="">
> In the Dashboard its shown as linux<br class="">
> All Domains or attacks or wha ever with - in the Word get broken.</p><p dir="ltr" class="">You need to use the .raw version of each keys to get it unanalyzed and then consider as a single expression.</p></div></blockquote></div>Mhh, i dont have .raw in the drop down menu. Do i have to configure something special in Filebeat maybe?</div>_______________________________________________<br class="">Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" class="">oisf-users@openinfosecfoundation.org</a><br class="">Site: <a href="http://suricata-ids.org" class="">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" class="">http://suricata-ids.org/support/</a><br class="">List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" class="">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br class="">Suricata User Conference November 9-11 in Washington, DC: <a href="http://oisfevents.net" class="">http://oisfevents.net</a></div></blockquote></div><br class=""></body></html>