# Filebeat Events are shown at Kibana Discovery, but not at SIEM

**URL:** <https://discuss.elastic.co/t/filebeat-events-are-shown-at-kibana-discovery-but-not-at-siem/237750>\
**Category:** SIEM\
**Created:** [June 19, 2020, 7:24am UTC](https://discuss.elastic.co/t/filebeat-events-are-shown-at-kibana-discovery-but-not-at-siem/237750 "2020-06-19T07:24:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alvaro\_Sanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alvaro_sanz/32/70648_2.png) [@Alvaro\_Sanz](https://discuss.elastic.co/u/Alvaro_Sanz)\
**Post date:** [June 19, 2020, 7:24am UTC](https://discuss.elastic.co/t/filebeat-events-are-shown-at-kibana-discovery-but-not-at-siem/237750/1 "2020-06-19T07:24:24Z")

</div>

Hello,

When I go to Kibana, I can see my filebeat events at Discovery tab. Nevertheless, if I go to SIEM \> Timeline, I cannot see any of those events.

Anyone has any idea why is it happening?

Thank you in advance.

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [June 23, 2020, 3:30am UTC](https://discuss.elastic.co/t/filebeat-events-are-shown-at-kibana-discovery-but-not-at-siem/237750/2 "2020-06-23T03:30:12Z")

</div>

What queries are you using within SIEM \> Timeline to show your events? Are you seeing anything at all if you do a wild card like this below?

```auto
*:*

```

---

<div class="post-metadata">

**Author:** ![Alvaro\_Sanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alvaro_sanz/32/70648_2.png) [@Alvaro\_Sanz](https://discuss.elastic.co/u/Alvaro_Sanz)\
**Post date:** [June 23, 2020, 6:05am UTC](https://discuss.elastic.co/t/filebeat-events-are-shown-at-kibana-discovery-but-not-at-siem/237750/3 "2020-06-23T06:05:00Z")

</div>

Hi Frank.

Thanks for the response. I have already solved this error. The index didnt have the default indexes names, so I had to go to Management \> Advanced Settings and add the index name to siem:defaultIndex field. After that, problem solved.

Thank you anyway.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 21, 2020, 6:05am UTC](https://discuss.elastic.co/t/filebeat-events-are-shown-at-kibana-discovery-but-not-at-siem/237750/4 "2020-07-21T06:05:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.