Hi all,
I am using Filebeat module cisco to get logs. I am not storing this logs in an index called filebeat-*
but cisco-*
. To get the correct mapping for this pattern, I exported the filebeat template and imported it for the pattern cisco-*
. Anyway, the SIEM Network Map tells me that
An ECS compliant Kibana index pattern must be configured to view event data on the map. When using beats, you can run the following setup commands to create the required Kibana index patterns, otherwise you can configure them manually within Kibana settings.
I already added cisco-*
to the default SIEM index search in management. But this doesn't seem to be solution. How can I add the cisco-*
to the map?
Cheers,
Marcus