I am struggling to set up visualisation for Zeek (Bro) logs with Kibana. The Zeek module included with filebeat apparently comes with a sample dashboard seen here. I am struggling to see the sample dashboard and setting up a visualisation for the conn.log from Zeek. I can see there is an index created using the configurations of filebeat:
filebeat.config.modules: enabled: true path: "/usr/share/filebeat/modules.d/*.yml" filebeat.modules: - module: zeek connection: enabled: true var.paths: - "/usr/local/bro/logs/current/conn.log" output.elasticsearch: hosts: ["x.x.xxx.xxx:9200"] setup.kibana: host: "x.x.xxx.xxx:5601"
I feel the documentation for the Zeek module is not enough. Could someone advise me further how to set this up?