Best way to load a pcap file into elasticsearch 7.11

Elastic Stack Elasticsearch
#1

Hi. I'm using elasticsearch 7.11 and I would like to ingest a pcap file into elasticsearch and kibana. What would be the best way to do this

I tried using the analyzing network packets guide(Analyzing network packets with Wireshark, Elasticsearch, and Kibana | Elastic) but it wouldn't work because the guide is for older versions of elasticsearch.

#2

tshark would be the best way to move with pcap files
The json generated may be not necessary ready to be bulked into ES latest versions, but i suggest you use logstash to clean the json before ingest it to ES.

#3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.