External IPs - Kibana Dashboard - Version 7.9.1

[krinfra (Kiss)]

Morning.

The module haproxy is enable.

cat haproxy.yml
# Module: haproxy
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-haproxy.html

- module: haproxy
  # All logs
  log:
    enabled: true

    # Set which input to use between syslog (default) or file.
    var.iput: "file"
    #["/srv/syslog/10.138.68.10/2020/*/*.log"]

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/srv/syslog/10.138.68.10/2020/*/*.log"]

Filebeat sending the data directly to Elasticsearch. I am not using Logstash.

[mattkime (Matthew Kime)]

https://www.elastic.co/guide/en/beats/filebeat/master/exported-fields-haproxy.html - shows the fields you should have available. Do you see source.address in your left sidebar field list?

[krinfra (Kiss)]

Only this:

[krinfra (Kiss)]

But I have this:

[krinfra (Kiss)]

Filebeat index > Discover > Search Field: source

[mattkime (Matthew Kime)]

What if you do a search for source.ip : * or source.address : * - I wonder if you have some docs without values.