# Event Correlation on ELK **URL:** \ **Category:** SIEM\ **Created:** [August 8, 2019, 6:47am UTC](https://discuss.elastic.co/t/event-correlation-on-elk/194362 "2019-08-08T06:47:07Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![alperensoydan](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@alperensoydan](https://discuss.elastic.co/u/alperensoydan)\ **Post date:** [August 8, 2019, 6:47am UTC](https://discuss.elastic.co/t/event-correlation-on-elk/194362/1 "2019-08-08T06:47:07Z")
Hello, I installed ELK as a SIEM and It works nicely. There is only one problem is that correlation of different events and it does not come default within ELK. According to my researches, Logstash filters work for this job but there is no decent document for it. My question is that: Is there a simple way for this job like an engine or plug-in? If it is not, how can I find a documentation about correlation on ELK? (with Logstash or another way) Also, logs can come from differebt sources like firewall and server. P.S. My structure: BEAT -\> Logstash -\> Elastic -\> Kibana ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [August 14, 2019, 12:59pm UTC](https://discuss.elastic.co/t/event-correlation-on-elk/194362/2 "2019-08-14T12:59:03Z")
Yes, for now you can look at using Logstash with, say, the memcache plugin to implement some correlations. See this [blog post](https://www.elastic.co/blog/elasticsearch-data-enrichment-with-logstash-a-few-security-examples) for some examples. In the future, we intend to have "correlation rules" (executed post-ingestion) that will be able to detect sequences of related events. Can you give one-two examples of correlations so we get a sense of what you are looking for? Thanks! ---
**Author:** ![alperensoydan](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@alperensoydan](https://discuss.elastic.co/u/alperensoydan)\ **Post date:** [August 26, 2019, 12:07pm UTC](https://discuss.elastic.co/t/event-correlation-on-elk/194362/3 "2019-08-26T12:07:08Z")
Thank you for your answer. I am going to read this blog. Unfortunately, I do not have clear cases but when I get it, I will write here. Best regards, ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 23, 2019, 12:07pm UTC](https://discuss.elastic.co/t/event-correlation-on-elk/194362/4 "2019-09-23T12:07:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.