Filebeat module's fields in SIEM columns

Elastic Security SIEM
1

Hi,

after upgrading our cluster from 7.10.2 to 7.11.1 we can no more see values of filebeat module's fields in columns, for example suricata's fields (screenshot below),

image
image913×195 8.49 KB

although they are included in the signal's fields.

image
image447×764 44.2 KB

Suricata module is parsed through logstash ingest pipeline and the pipeline and filebeat on the host are upgraded to the latest version. In the suricata index, suricata fields have their appropriate mappings, but the situation is not the same in the signals index, as you can see on the picture above, where suricata fields have question mark instead of field type.

image
image1413×282 18.7 KB

What should I do to acquire the same mapping, or something else, that would lead to previous behaviour before upgrade, where I could normally see the fields' values in the columns for non-directly ECS fields?

1 Like
2

We have an issue for it you can watch here. Un-indexed fields aren't being shown in the columns:

2 Likes
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.