Extract the message from an Alert FileBeat

Elastic Stack Beats
1

I need help because I don't know how to select only the part of the message where it says "NMAP ping sweep Scan".

05/28-10:30:30:52.840974 [**] [1:10000004:1] "NMAP ping sweep Scan" [**] [Priority: 0] {TCP}

I got this:

 processors:
    - dissect:
        tokenizer: ' "%{service.message}" '
        filed: "message"
        target_prefix: "message"
2

This Beats Playground allows to play around with beats processors and extract the data, hope t hat helps to get started

https://andrewkroh.github.io/beats-playground/

1 Like
3

Ohhh, thank you very much :slight_smile:

4

I have a question, what is the reason for this part of the code?

layouts:
      - 2006-01-02T15:04:05.999999999Z07:00
5

See Timestamp | Filebeat Reference [7.13] | Elastic - a list of timestamps that should be able to parse.. this one aims at nanosecond resolution and time zones I would guess

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.