# Dashboards for Suricata \> Filebeat \> Logstash Setup

**URL:** <https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [December 27, 2024, 2:35am UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436 "2024-12-27T02:35:36Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![elastirroot](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@elastirroot](https://discuss.elastic.co/u/elastirroot)\
**Post date:** [December 27, 2024, 2:35am UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/1 "2024-12-27T02:35:36Z")

</div>

Hi,

I have my Stack setup across two machines. The first with Suricata and filebeat and the other logstash and Kibana/Elasticsearch. tcpdump confirms logs are being sent over and I recently figured out how to import my filebeat index template into kibana using the file export method; however I'm at a lost as to how to view any of my data via the dashboards. The built in Suricata dashboard seems to only be for data sent via the agent therefore everything says no data.

How do I view my data in Kibana that is ingested via Logstash? Is it possible to change the default dashboard to use my filebeat-8.16.0 index recently added? Any help would greatly be appreciated!!!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 27, 2024, 4:24pm UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/2 "2024-12-27T16:24:24Z")

</div>

Hi @elastirroot, Welcome to the community!

A couple of things.

Are you sure you need logstash? Logstsash is great but is not necessarily needed for this? Are you following some other article etc?

> [@elastirroot](#):
>
> The built in Suricata dashboard seems to only be for data sent via the agent therefore everything says no data.

No, that is not necessarily correct... but depending on what you did .. .could be confusing...

My Suggestion is to get the simple direct path working first. .

filebeat \> elasticsearch

Once that is working, we can show you how to "Pass it through" logstash if needed

To do this, follow the Filebeat Quickstart **very carefully** and substitute the suricate modules for the `nginx` module in the

Set the filebeat.yml to point to Kibana and Elasticsearch  
Enable the `suricata` module  
run setup `filebeat setup -e`  
run filebeat  
Check the data and the dashboards

> **[Filebeat quick start: installation and configuration | Filebeat Reference...](https://www.elastic.co/guide/en/beats/filebeat/8.16/filebeat-installation-configuration.html)**

Once you get everything working, come back, and we can show you how to use logstash in the middle if it is still needed.

---

<div class="post-metadata">

**Author:** ![elastirroot](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@elastirroot](https://discuss.elastic.co/u/elastirroot)\
**Post date:** [December 27, 2024, 5:12pm UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/3 "2024-12-27T17:12:36Z")

</div>

I ran into this project through a 'Tuber' and an article as you suspected: [GitHub - robcowart/synesis\_lite\_suricata: Suricata IDS/IPS log analytics using the Elastic Stack.](https://github.com/robcowart/synesis_lite_suricata).. There it suggested the logstash path.

I'll try the filebeat \> elastic path as you suggested.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 27, 2024, 5:18pm UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/4 "2024-12-27T17:18:08Z")

</div>

Rob is awesome! but that particular article /repo is 5 Years Old!!! which is a lifetime in tech 🙂 and as noted

### THIS PROJECT HAS BEEN ARCHIVED!

Get the the filebeat \> elasticsearch route working and then come back if needed.

---

<div class="post-metadata">

**Author:** ![elastirroot](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@elastirroot](https://discuss.elastic.co/u/elastirroot)\
**Post date:** [December 28, 2024, 4:38am UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/5 "2024-12-28T04:38:05Z")

</div>

Thank you much for the direction. I'm further than ever before. I can go into kibana and find data streaming in via the discovery section using the 'filebeat-\*' filter. However, when moving over to dashboards, there is no data although there are no errors anymore (see attached).

I have both the nginx and the suricata modules enabled. All fileset settings pointing to the same /var/log/suricata/eve.json file (\<--- is this correct?). I know I'm close but just need the extra insight as to how to get my suricata dashboards populated, the entire reasoning for this adventure. Any help is appreciated.

 ![ElasticDiscover](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04520e7c579665fa22709999cdc0f7b5999b2c4e.png)

---

<div class="post-metadata">

**Author:** ![elastirroot](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@elastirroot](https://discuss.elastic.co/u/elastirroot)\
**Post date:** [December 28, 2024, 4:38am UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/6 "2024-12-28T04:38:44Z")

</div>

![ElasticSuricataDashboard](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3dab368fae3f69009753a4c40ef754924ba1427d.png)

---

<div class="post-metadata">

**Author:** ![elastirroot](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@elastirroot](https://discuss.elastic.co/u/elastirroot)\
**Post date:** [December 28, 2024, 4:51am UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/7 "2024-12-28T04:51:39Z")

</div>

Sorry for the multi post, but as a noob, I can only add one image per post. This is the last image showing the Nginx dashboard(s) also show no data. Your help is appreciated.

 ![Nginx](https://us1.discourse-cdn.com/elastic/original/3X/9/8/98ea67d0af6b332764e6f63a920552e391cd0e14.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 28, 2024, 5:23am UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/8 "2024-12-28T05:23:13Z")

</div>

> [@elastirroot](#):
>
> I have both the nginx and the suricata modules enabled. All fileset settings pointing to the same /var/log/suricata/eve.json file (\<--- is this correct?).

No, that is not correct.

1st, if you do not have the Nginx logs, do not enable that module...

Apologies if I was not clear. I meant to follow the quickstart and use the `suricata` module instead of ngnix. If you do not have ngnix, disable it.

`./filebeat modules disable nginx`

I am not sure what state you are in at this point... you may have loaded the suricata logs into the ngnix dataset... I am not sure what you have...

Lets see what you got...

```auto
FROM filebeat-*
| WHERE event.dataset == "suricata.eve"

```

Open one of the docs and past the JSON in here

Then Try to see what you are getting...

```auto
FROM filebeat-*
| WHERE event.dataset == "suricata.eve"
| STATS COUNT(*) BY event.category

```

See what kind of events you have...

```auto
FROM filebeat-*
| WHERE event.dataset == "suricata.eve"
| STATS COUNT(*) BY event.kind

```

Also did you look at the Alerts dashboard...

What kind of suricata data do you think you are loading?

Lets see what you have and see if we can fix... may be tomorrow late here

---

<div class="post-metadata">

**Author:** ![elastirroot](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@elastirroot](https://discuss.elastic.co/u/elastirroot)\
**Post date:** [December 28, 2024, 5:27pm UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/9 "2024-12-28T17:27:39Z")

</div>

FYI - I disabled Nginx, enabled Suricata and pointed filebeat to suricata logs.

++  
filebeat.inputs:

- type: filestream  
enabled: true  
paths:

...  
++++  
Also provided the following in module for suricata

filebeat.inputs:

- type: filestream  
enabled: true  
paths:

plus my auth ssl stuff  
...

> [@stephenb](#):
>
> ```auto
> FROM filebeat-*
> | WHERE event.dataset == "suricata.eve"
> 
> ```

Unfortunately, nothing is returned from this query, much less any of the drill downs from here.

I'm hoping to show all available data from suricata. I guess my assumption is that unless I filtered something, I should see everything at least to start with.

Again, after configuring all types of ssl settings which work, the elastic stack is confusing to me as to why I can see data in discover but nothing in any of the visualizations. I'm sure Its a me thing. Your direction again is appreciated

---

<div class="post-metadata">

**Author:** ![elastirroot](https://avatars.discourse-cdn.com/v4/letter/e/b5ac83/32.png) [@elastirroot](https://discuss.elastic.co/u/elastirroot)\
**Post date:** [December 29, 2024, 1:30am UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/10 "2024-12-29T01:30:32Z")

</div>

> [@stephenb](#):
>
> ```auto
> FROM filebeat-*
> | WHERE event.dataset == "suricata.eve"
> | STATS COUNT(*) BY event.kind
> 
> ```

I wish I could say what I did, but I'm not sure. At some point I found my suricata not running and restarted it. From there, the dashboards started populating.

 ![SuricataDash](https://us1.discourse-cdn.com/elastic/original/3X/d/8/d86ce6e010fd43edc27bac45b65c475d1892fd8c.png)

I'll start looking at the other dashes and see if I can get more meaningful data, but I think I'm good from here. Thank you so much.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 29, 2024, 1:41am UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/11 "2024-12-29T01:41:43Z")

</div>

Cool... Glad we could help.

If you do not have nginx ... Disable that module, in general you don't want 2 modules or inputs pointing to the same file set.

@elastirroot

Also do not enable the filestream in the filebeat.yml ONLY enable the suricata.yml.

Multiple inputs pointing to the same fileset is not good / not needed

Not sure why you are adding

> [@elastirroot](#):
>
> fields:  
> event.type: suricata

The modules are selk contained.... Overriding things like event.type can have not good side affects

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 29, 2024, 3:10am UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436/12 "2024-12-29T03:10:19Z")

</div>

@elastirroot see above

So recap.. .

Enable the suricata module ... Nothing else

Do not add more filestreams in the filebeat.yml nor extraneous fields unless you know what you are doing... And you know they do not conflict with existing fields ... The dashboards are driven by the correct schema and values