Filebeat to ship bro logs - notice logs to kibana

[Ikenahim]

I set up Bro and ELK I managed to ship logs of Bro/Zeek to ELK server where ELK is configured to receive logs using Filebeat Zeek modul without going via Logstash. works perfectly.
Now I want to ship notice log of Zeek to ELK server but in the filebeat zeek modul which doesnt support notice logs. is there a way to make these notice logs shown in Kibana as alert ?

Thank you

[andrewkroh]

There is some work in progress to add the other Zeek logs types https://github.com/elastic/beats/pull/13683. You could try testing the source code in that PR and see how it works.

Otherwise you would want to copy of the existing filesets in the zeek module folder and then modify it to handle the notice log.

[Ikenahim]

Thank you I have updated filebeat to version 7.3 which supports shipping Zeek notice.log to Kibana. however, I couldnt see it in Kibana i aslo updated to version 7.3, also Elasticsearch is updated to 7,3 . where i exactly i can see the notice.log in Kibana ? thank you