# Filebeat pipping Suricatas eve.json issues

**URL:** <https://discuss.elastic.co/t/filebeat-pipping-suricatas-eve-json-issues/225890>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 31, 2020, 2:39pm UTC](https://discuss.elastic.co/t/filebeat-pipping-suricatas-eve-json-issues/225890 "2020-03-31T14:39:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![eriknox](https://avatars.discourse-cdn.com/v4/letter/e/b9bd4f/32.png) [@eriknox](https://discuss.elastic.co/u/eriknox)\
**Post date:** [March 31, 2020, 2:39pm UTC](https://discuss.elastic.co/t/filebeat-pipping-suricatas-eve-json-issues/225890/1 "2020-03-31T14:39:10Z")

</div>

Hello all,

I have Elastic 7.6.1 up and running without the use of Logstash. My issue that I have is that I cannot get Filebeat to ingest Suricata. I have the module imported. Suricata is alerting and dropping the json into the eve.json file. Filebeat is configured to look in there and has loaded the dashboards. I can be more verbose, just let me know what you need to know.

> /etc/filebeat/modules.d/suricata.yml

```auto
#Module: suricata
- module: suricata
  #All logs
  eve:
    enabled: true
    var.paths: [“/usr/local/var/log/suricata/eve.json”]
   

```

> filebeat.yml

`````````````````````````````````````auto
setup.kibana:
  host: "192.168.1.200:5601"
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
output.elasticsearch:
  hosts: ["192.168.1.200:9200"]

````````````````````````````````````

Any help would be much appreciated.
`````````````````````````````````````

---

<div class="post-metadata">

**Author:** ![eriknox](https://avatars.discourse-cdn.com/v4/letter/e/b9bd4f/32.png) [@eriknox](https://discuss.elastic.co/u/eriknox)\
**Post date:** [March 31, 2020, 5:55pm UTC](https://discuss.elastic.co/t/filebeat-pipping-suricatas-eve-json-issues/225890/2 "2020-03-31T17:55:37Z")

</div>

Solved. var.paths: [“/usr/local/var/log/suricata/eve.json”]

The quotations were copied from another document and they were "enriched"....

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [April 1, 2020, 10:05am UTC](https://discuss.elastic.co/t/filebeat-pipping-suricatas-eve-json-issues/225890/3 "2020-04-01T10:05:16Z")

</div>