# Configure Zeek module with the sample dashboard

**URL:** <https://discuss.elastic.co/t/configure-zeek-module-with-the-sample-dashboard/188951>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 4, 2019, 4:34pm UTC](https://discuss.elastic.co/t/configure-zeek-module-with-the-sample-dashboard/188951 "2019-07-04T16:34:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Merril](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@Merril](https://discuss.elastic.co/u/Merril)\
**Post date:** [July 4, 2019, 4:34pm UTC](https://discuss.elastic.co/t/configure-zeek-module-with-the-sample-dashboard/188951/1 "2019-07-04T16:34:17Z")

</div>

Hi all,

I am struggling to set up visualisation for Zeek (Bro) logs with Kibana. The Zeek module included with filebeat apparently comes with a sample dashboard [seen here](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-zeek.html). I am struggling to see the sample dashboard and setting up a visualisation for the conn.log from Zeek. I can see there is an index created using the configurations of filebeat:

```
filebeat.config.modules:
  enabled: true
  path: "/usr/share/filebeat/modules.d/*.yml"
filebeat.modules:
  - module: zeek
    connection:
      enabled: true
      var.paths:
        - "/usr/local/bro/logs/current/conn.log"

output.elasticsearch:
  hosts: ["x.x.xxx.xxx:9200"]

setup.kibana:
   host: "x.x.xxx.xxx:5601"

```

I feel the documentation for the Zeek module is not enough. Could someone advise me further how to set this up?

Kind regards,  
Merril.

---

<div class="post-metadata">

**Author:** ![faec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faec/32/46988_2.png) [@faec](https://discuss.elastic.co/u/faec)\
**Post date:** [July 5, 2019, 10:25pm UTC](https://discuss.elastic.co/t/configure-zeek-module-with-the-sample-dashboard/188951/2 "2019-07-05T22:25:52Z")

</div>

Can you tell if your difficulty is with filebeat or kibana? You say you can see an index created, does that mean that the zeek logs are being indexed in elasticsearch, but you don't see the dashboard? Or are you unsure if the logs are being indexed at all?

---

<div class="post-metadata">

**Author:** ![Merril](https://avatars.discourse-cdn.com/v4/letter/m/a87d85/32.png) [@Merril](https://discuss.elastic.co/u/Merril)\
**Post date:** [July 8, 2019, 8:07am UTC](https://discuss.elastic.co/t/configure-zeek-module-with-the-sample-dashboard/188951/3 "2019-07-08T08:07:43Z")

</div>

Hi Fae,

I can see index on ES and indeed in Kibana and I could create an index pattern and discover the documents. But no default dashboard on Kibana. I assume its a filebeat configuration?. I am using docker so it would be easier for me to configure through filebeat.yml if there is a setting I can apply.

Kind regards,  
Merril.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 5, 2019, 8:07am UTC](https://discuss.elastic.co/t/configure-zeek-module-with-the-sample-dashboard/188951/4 "2019-08-05T08:07:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.