Filebeat module's fields in SIEM columns


after upgrading our cluster from 7.10.2 to 7.11.1 we can no more see values of filebeat module's fields in columns, for example suricata's fields (screenshot below),

although they are included in the signal's fields.

Suricata module is parsed through logstash ingest pipeline and the pipeline and filebeat on the host are upgraded to the latest version. In the suricata index, suricata fields have their appropriate mappings, but the situation is not the same in the signals index, as you can see on the picture above, where suricata fields have question mark instead of field type.

What should I do to acquire the same mapping, or something else, that would lead to previous behaviour before upgrade, where I could normally see the fields' values in the columns for non-directly ECS fields?

1 Like

We have an issue for it you can watch here. Un-indexed fields aren't being shown in the columns:


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.