ELK 5.6.8
Filebeat 6.2.1
I have question,
For filebeat 6.2.1 on the prospector -> document_type is still used or not
- field:
tags:
- SuricataIDPS
- JSON
document_type: suricataIDPS
fields_under_root: true
type: log
paths:
- /var/log/suricata/*/eve.json*