Filebeat Index Variables

I'm sure this is already written somewhere, but I am obviously looking for the wrong words.

I just started using the SIEM in 7.2 and its working pretty good
I am using Filebeat modules for Zeek and Suricata. I want each of them to go into their own index something like filebeat-{MODULE-DATE} but I can't figure out how to do that. I'm assuming there is a module variable set somewhere..
Can this be done with filebeat? Or do i need to pass through a Logstash instance to accomplish this? Is there a list of filebeat system variables?


Hello @KWBrandenWagner,

Yes all modules add data to the events and you can use them after to generate the index. If you define the index in the output using the following I believe you will get what you want.

  index: "filebeat-%{[event.module]}-%{+yyyy.MM.dd}"

You might have to check your index pattern in kibana after, to make sure the siem app see the data.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.