We have a beat with the panw module enabled collecting data from Palo Alto Firewalls. The data is being received by Elasticsearch but there are no documents. We have confirmed with a tcpdump the data is arriving from the firewall to the beat. I enabled DEBUG logging in Filebeat and confirmed even…

(I reformatted your posts to preserve whitespace with the </> button) [image] dsdameron: { "set" : { "field" : "event.category", "value" : "network_traffic", "if" : "ctx?._temp_?.message_type == \"TRAFFIC\"" …

Elastic Search is receiving data from beat, but no documents appear

Elastic Stack Elasticsearch

system (system) Closed March 9, 2020, 7:44pm 16

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Filebeat is running on two different systems with two different modules but no documents appear in filebeat indx Beats	2	500	March 6, 2020
Filebeat: connection to Elasticsearch OK but no documents indexed Beats filebeat	9	137	October 2, 2025
Elasticsearch does not receive Filebeat data Beats filebeat	4	1483	April 3, 2020
ElasticSearch output of Filebeat is empty, displays http error 400 Bad Request Beats elastic-stack-monitoring , filebeat	33	2141	March 27, 2024
Filebeat and updating existing docs Beats filebeat	31	3168	February 6, 2023

Elastic Search is receiving data from beat, but no documents appear

Related topics