<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">Am 18.06.2016 um 12:46 schrieb Eric Leblond <<a href="mailto:eric@regit.org" class="">eric@regit.org</a>>:</div><br class="Apple-interchange-newline"><div class=""><p dir="ltr" class="">Hi,<br class="">
Le 18 juin 2016 11:07 AM, Daniel Eschner <<a href="mailto:daniel@linux-nerd.de" class="">daniel@linux-nerd.de</a>> a écrit :<br class="">
><br class="">
> Hi there,<br class="">
><br class="">
> i run Suricata on a pfSense. I Try to build some Dashboards. For the First everthing seems running but it seems i have Problems with domains like <a href="http://linux-nerd.de" class="">linux-nerd.de</a><br class="">
> In the Dashboard its shown as linux<br class="">
> All Domains or attacks or wha ever with - in the Word get broken.</p><p dir="ltr" class="">You need to use the .raw version of each keys to get it unanalyzed and then consider as a single expression.</p></div></blockquote></div>Mhh, i dont have .raw in the drop down menu. Do i have to configure something special in Filebeat maybe?</body></html>