Custom index does NOT show in Kibana

[panagiss]

I'm outputting a custom index from Logstash to Elastisearch but it won't show in KIbana's main dashboards (e.g. Security panel / data sources).

While it will show in index management in settings.

Here is the how output data into the index from logstash:

output{

    elasticsearch{
        hosts => ["https://localhost:9200"]
        index => "logstash-misp-enriched"
        user => logstash_user
        password => "apass"
        ssl => true
        cacert => "./elasticsearch-ca.pem"
        http_compression => true
	sniffing => false
    }
}

[stephenb (Stephen Brown)]

Did you create and index pattern?
Index patterns is what dashboards work with not individual indices

Create an index pattern | Kibana Guide [7.14] | Elastic

[panagiss]

Thanks for the answer. It cleared a lot of things in my head.
One more question:

I make my own custom schema in terms of event fields. So do i have to use the ECS, or few of the ECS's fields, or i can make my own visualizations in Kibana with custom fields?

What do you suggest?
Thanks again

[stephenb (Stephen Brown)]

Glad we could help.

That's a bit bigger question.

There are certainly advantaged of mapping to ECS If you want to take advantage of the security analytics applications within Kibana and some of the default detections and other features etc.

But it's not required if you want to do everything custom.

You can read about that here

Elastic Security fields and object schemas | Elastic Security Solution [7.14]...