# Can't see Suricata events in Kibana

**URL:** <https://discuss.elastic.co/t/cant-see-suricata-events-in-kibana/171516>\
**Category:** Logstash\
**Created:** [March 8, 2019, 2:47pm UTC](https://discuss.elastic.co/t/cant-see-suricata-events-in-kibana/171516 "2019-03-08T14:47:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![thoarau](https://avatars.discourse-cdn.com/v4/letter/t/a88e4f/32.png) [@thoarau](https://discuss.elastic.co/u/thoarau)\
**Post date:** [March 8, 2019, 2:47pm UTC](https://discuss.elastic.co/t/cant-see-suricata-events-in-kibana/171516/1 "2019-03-08T14:47:31Z")

</div>

I'm trying to send Suricata event to the ELK stack . I have the ELK stack on a server and on an other server I have Suricata and Filebeat. I activated the filebeat suricata module and Filebeat send event from eve.json file to Logstash.

At the begining I saw this message on the Kibana logs panel :  
`failed to format message from /var/log/suricata/eve.json`  
But i saw on the suricata events overviws dashboard that events are send but I don't saw analyse of this events.

After some research and after change config file, I don't have any more the previous message but unfortunately, I have no more events on the dashboard.

My differents config file :

```
input {
  beats {
    port => 5044
    codec => "json_lines"
  }
}

filter {
  if [application] == "suricata" {
    date {
      match => ["timestamp", "ISO8601"]
    }
    ruby {
      code => "
      if event.get('[event_type]') == 'fileinfo'
         event.set('[fileinfo][type]', event.get('[fileinfo][magic]').to_s.split(',')[0])
      end
      "
    }
    if [src_ip] {
    geoip {
      source => "src_ip"
      target => "geoip"
      database => "/etc/logstash/GeoLite2-City.mmdb"
      add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
    }
    mutate {
      convert => ["[geoip][coordinates]", "float" ]
    }
    if ![geoip.ip] {
      if [dest_ip] {
        geoip {
          source => "dest_ip"
          target => "geoip"
          database => "/etc/logstash/GeoLite2-City.mmdb"
          add_field => ["[geoip][coordinates]", "%{[geoip][longitude]}" ]
          add_field => ["[geoip][coordinates]", "%{[geoip][latitude]}" ]
        }
        mutate {
          convert => ["[geoip][coordinates]", "float" ]
        }
      }
    }
  }
 }
}

{
  "template" : "suricata-*",
  "version" : 50001,
  "settings" : {
    "number_of_replicas": 0,
    "index.refresh_interval" : "5s"
  },
  "mappings" : {
    "_default_" : {
      "_all" : {"enabled" : true, "norms" : false},
      "dynamic_templates" : [ {
        "message_field" : {
          "path_match" : "message",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text",
            "norms" : false
          }
        }
      }, {
        "string_fields" : {
          "match" : "*",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text", "norms" : false,
            "fields" : {
              "keyword" : { "type": "keyword", "index": "not_analyzed", "ignore_above": 256 },
              "raw" : { "type": "keyword", "index": "not_analyzed", "ignore_above": 256 }
            }
          }
        }
      } ],
      "properties" : {
        "@timestamp": { "type": "date", "include_in_all": false },
        "@version": { "type": "keyword", "include_in_all": false },
        "geoip" : {
          "dynamic": true,
          "properties" : {
            "ip": { "type": "ip" },
            "location" : { "type" : "geo_point" },
            "latitude" : { "type" : "half_float" },
            "longitude" : { "type" : "half_float" }
          }
        },
        "dest_ip": {
            "type": "ip",
            "fields": {
                "raw": {"index": "not_analyzed", "type": "keyword"},
                "keyword": {"index": "not_analyzed", "type": "keyword"}
             }
        },
        "src_ip": {
            "type": "ip",
            "fields": {
                "raw": {"index": "not_analyzed", "type": "keyword"},
                "keyword": {"index": "not_analyzed", "type": "keyword"}
             }
        }
      }
    }
  }
}

output {
 if [application] == "suricata" {
  elasticsearch {
   hosts => ["localhost:9200"]
   index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
   #document_type => "suricata"
   template => "/etc/logstash/elasticsearch5-template.json"
   template_overwrite => false
  }
 }
}

```

Thank you in advance !

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [March 10, 2019, 2:54am UTC](https://discuss.elastic.co/t/cant-see-suricata-events-in-kibana/171516/2 "2019-03-10T02:54:57Z")

</div>

Usually you want to use the stdout plugin in Logstash to see if events are processed properly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 7, 2019, 2:56am UTC](https://discuss.elastic.co/t/cant-see-suricata-events-in-kibana/171516/3 "2019-04-07T02:56:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.