Fielddata is disabled

Elastic Security SIEM
1

Hello.

I upgraded from Elastic Stack version 6.8 to 7.4. I installed AudioBeat on all my servers, with the configuration below.

auditbeat.modules:

- module: auditd
  audit_rule_files: [ '${path.config}/audit.rules.d/*.conf' ]
  audit_rules: |
- module: file_integrity
  paths:
  - /bin
  - /usr/bin
  - /sbin
  - /usr/sbin
  - /etc
  - /opt

- module: system
  datasets:
    - host    # General host information, e.g. uptime, IPs
    - login   # User logins, logouts, and system boots.
    - package # Installed, updated, and removed packages
    - process # Started and stopped processes
    - socket  # Opened and closed sockets
    - user    # User information

  user.detect_password_changes: true

  login.wtmp_file_pattern: /var/log/wtmp*
  login.btmp_file_pattern: /var/log/btmp*

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:

  host: "http://yspp0051.ymdb.com.br:80"

output.elasticsearch:
  hosts: ["yspp0053.ymdb.com.br:9200"]

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

I set up SIEM on Elastic Stack and everything was normal until yesterday. Today is presenting the following error:

uncommon_process
uncommon_process.png1528×782 57.3 KB

process
process.png1578×727 40 KB

My mapping is:

https://justpaste.it/3hl4g

Can you help me solve? I'm new to Elastic Stack and I don't know much.

2

Can someone help me?

Thanks

3

Hi @Manoel, did you run ./auditbeat setup before running Auditbeat? This sets up the index with the proper data types. The error looks like it does not have the right ones.

4

Hello @cwurm, thanks for the support.

I scripted Ansible to automate the installation of AuditBeat on my 150 Linux servers. In the process I have the command: sudo auditbeat setup

In the log I can know which server is sending the wrong information?

5

Hi Manoel did you find out what was the problem? I'm having the same issue with Filebeat and ES 7.4.2

6

@Manoel ./auditbeat setup should be run only once, not more.

@Manoel, @fredrcc In general, you should run ./auditbeat setup once from an admin machine, then only run ./auditbeat on the monitored machines. You can test it works by running both against an empty Elasticsearch cluster. If it doesn't work in your environment, there must be some difference - e.g. you're not using the default index pattern, the setup command failed - or something else.

7

I've run filebeat setup from the logstash server, because it's the only server with access to the ES and Kibana. Then I start filebeat from a client to send logs to my logstash.

I've tried to remove the filebeat index, index templates and dashboards and re-run filebeat setup again, but it didn't work too. There's any configuration else to remove to start a fresh filebeat setup on a production ES?

Regards.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.