<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr">Try filebeat-*</div><div dir="ltr"><br><blockquote type="cite">On May 10, 2020, at 5:25 PM, Russell Fulton <r.fulton@auckland.ac.nz> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
I am attempting to get eve.json data into elasticsearch.
<div class=""><br class="">
</div>
<div class="">I found filebeat and noted that it had a suricata plugin. Installed it (following the instruction in the docs). </div>
<div class=""><br class="">
</div>
<div class="">At first I could not find the index and the doc were not forthcoming about the naming. Eventually I figured out that it was called filebeat-….. By that time the index contained 50GB of data and was marked as closed. </div>
<div class=""><br class="">
</div>
<div class="">I can’t do anything with the closed index, even delete it. I have tried opening it by sending API request but that comes back with “acknowledged” but nothig changes. Filebeat logs suggest it it still sendingdata to ES???</div>
<div class=""><br class="">
</div>
<div class="">I tried changing the index name but filebeat now insists that I now need to load the templates for the new index without saying how. Re-running
<font face="Menlo" class="">filebeat —setup</font> does not do it.</div>
<div class=""><br class="">
</div>
<div class="">Before spending more time going around in circles I thought I would ask what others are doing to get their eve logs into ES so that they can use Evebox — which is next on my list of things to look at once I get the data loading into ES.</div>
<div class=""><br class="">
</div>
<div class="">Russell</div>
<span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org</span><br><span>Site: http://suricata-ids.org | Support: https://suricata-ids.org/support/</span><br><span>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</span><br><span></span><br><span>Forum: https://forum.suricata.io</span><br><span>Trainings: https://suricata-ids.org/training/</span></div></blockquote></body></html>