External IPs - Kibana Dashboard - Version 7.9.1

Elastic Stack Kibana
24

Morning.

The module haproxy is enable.

cat haproxy.yml
# Module: haproxy
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-haproxy.html

- module: haproxy
  # All logs
  log:
    enabled: true

    # Set which input to use between syslog (default) or file.
    var.iput: "file"
    #["/srv/syslog/10.138.68.10/2020/*/*.log"]

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/srv/syslog/10.138.68.10/2020/*/*.log"]

Filebeat sending the data directly to Elasticsearch. I am not using Logstash.

25

https://www.elastic.co/guide/en/beats/filebeat/master/exported-fields-haproxy.html - shows the fields you should have available. Do you see source.address in your left sidebar field list?

26

Only this:

image
image570×1071 55.7 KB

27

But I have this:

image
image800×658 36.9 KB

28

Filebeat index > Discover > Search Field: source

image
image974×1024 105 KB

29

What if you do a search for source.ip : * or source.address : * - I wonder if you have some docs without values.