Filebeat pipping Suricatas eve.json issues

Elastic Stack Beats
1

Hello all,

I have Elastic 7.6.1 up and running without the use of Logstash. My issue that I have is that I cannot get Filebeat to ingest Suricata. I have the module imported. Suricata is alerting and dropping the json into the eve.json file. Filebeat is configured to look in there and has loaded the dashboards. I can be more verbose, just let me know what you need to know.

/etc/filebeat/modules.d/suricata.yml

#Module: suricata
- module: suricata
  #All logs
  eve:
    enabled: true
    var.paths: [“/usr/local/var/log/suricata/eve.json”]

filebeat.yml

setup.kibana:
  host: "192.168.1.200:5601"
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
output.elasticsearch:
  hosts: ["192.168.1.200:9200"]

````````````````````````````````````

Any help would be much appreciated.
2

Solved. var.paths: [“/usr/local/var/log/suricata/eve.json”]

The quotations were copied from another document and they were "enriched"....