An ECS compliant Kibana index pattern must be configured to view event data on the map

#1

Hi all,
I am using Filebeat module cisco to get logs. I am not storing this logs in an index called filebeat-* but cisco-*. To get the correct mapping for this pattern, I exported the filebeat template and imported it for the pattern cisco-*. Anyway, the SIEM Network Map tells me that

An ECS compliant Kibana index pattern must be configured to view event data on the map. When using beats, you can run the following setup commands to create the required Kibana index patterns, otherwise you can configure them manually within Kibana settings.

I already added cisco-* to the default SIEM index search in management. But this doesn't seem to be solution. How can I add the cisco-* to the map?

Cheers,
Marcus

#2

Hi Marcus,

To confirm, you need two things:

  1. Add cisco-* for "SIEM Elasticsearch indices" under the Kibana Advanced Settings
  2. A Kibana index pattern for cisco-*, which you can add under Kibana Management / Index Patterns.

Do you have both?

#3

Seems, it was my fault.
I added cisco-* to my SIEM settings, but the index pattern was set to cisco-asa-*. After changing it to cisco-* the error disappeared.

Cheers,
Marcus

#4

I'm seeing this same error after upgrading to v7.5. I think it's due to an inconsistency in the field name that the visualization is looking for. ECS normalizes destination fields to the destination base name, but the documentation in v7.5 suddenly says to use the dest base field. See the screenshot attached.

ecs_geo_error
ecs_geo_error.png821×595 129 KB

I have geolocation data stored as a geo_point field at destination.geo.location. I've got a custom visualization in my other dashboards that renders data from the same index just fine.

#5

Thanks for pointing that out. I've opened a PR to fix it.