I installed ELK as a SIEM and It works nicely. There is only one problem is that correlation of different events and it does not come default within ELK. According to my researches, Logstash filters work for this job but there is no decent document for it. My question is that: Is there a simple way for this job like an engine or plug-in? If it is not, how can I find a documentation about correlation on ELK? (with Logstash or another way) Also, logs can come from differebt sources like firewall and server.
P.S. My structure: BEAT -> Logstash -> Elastic -> Kibana