# Filebeat to ship bro logs - notice logs to kibana

**URL:** <https://discuss.elastic.co/t/filebeat-to-ship-bro-logs-notice-logs-to-kibana/201752>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 1, 2019, 8:28am UTC](https://discuss.elastic.co/t/filebeat-to-ship-bro-logs-notice-logs-to-kibana/201752 "2019-10-01T08:28:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ikenahim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikenahim/32/51553_2.png) [@Ikenahim](https://discuss.elastic.co/u/Ikenahim)\
**Post date:** [October 1, 2019, 8:28am UTC](https://discuss.elastic.co/t/filebeat-to-ship-bro-logs-notice-logs-to-kibana/201752/1 "2019-10-01T08:28:02Z")

</div>

I set up Bro and ELK I managed to ship logs of Bro/Zeek to ELK server where ELK is configured to receive logs using Filebeat Zeek modul without going via Logstash. works perfectly.  
Now I want to ship notice log of Zeek to ELK server but in the filebeat zeek modul which doesnt support notice logs. is there a way to make these notice logs shown in Kibana as alert ?

Thank you

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 4, 2019, 11:28am UTC](https://discuss.elastic.co/t/filebeat-to-ship-bro-logs-notice-logs-to-kibana/201752/2 "2019-10-04T11:28:41Z")

</div>

There is some work in progress to add the other Zeek logs types [https://github.com/elastic/beats/pull/13683](https://github.com/elastic/beats/pull/13683). You could try testing the source code in that PR and see how it works.

Otherwise you would want to copy of the existing filesets in the zeek module folder and then modify it to handle the notice log.

---

<div class="post-metadata">

**Author:** ![Ikenahim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikenahim/32/51553_2.png) [@Ikenahim](https://discuss.elastic.co/u/Ikenahim)\
**Post date:** [October 4, 2019, 12:34pm UTC](https://discuss.elastic.co/t/filebeat-to-ship-bro-logs-notice-logs-to-kibana/201752/3 "2019-10-04T12:34:33Z")

</div>

Thank you I have updated filebeat to version 7.3 which supports shipping Zeek notice.log to Kibana. however, I couldnt see it in Kibana i aslo updated to version 7.3, also Elasticsearch is updated to 7,3 . where i exactly i can see the notice.log in Kibana ? thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 1, 2019, 12:34pm UTC](https://discuss.elastic.co/t/filebeat-to-ship-bro-logs-notice-logs-to-kibana/201752/4 "2019-11-01T12:34:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.