# Have a problem with my Suricata + ELK stack **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 13, 2021, 1:31pm UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364 "2021-08-13T13:31:11Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Yves\_Silvere\_Randria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yves_silvere_randria/32/92239_2.png) [@Yves\_Silvere\_Randria](https://discuss.elastic.co/u/Yves_Silvere_Randria)\ **Post date:** [August 13, 2021, 1:31pm UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/1 "2021-08-13T13:31:11Z")
Hello, I have this error when I am setting up ELK servers + Suricata . ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8a95e8713d9203abbd10b1379525389d338afb4f.png) ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [August 13, 2021, 2:54pm UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/2 "2021-08-13T14:54:03Z")
It looks like u have a permissions problem. What user are u logged in as and what roles/permissions does it have? ---
**Author:** ![Yves\_Silvere\_Randria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yves_silvere_randria/32/92239_2.png) [@Yves\_Silvere\_Randria](https://discuss.elastic.co/u/Yves_Silvere_Randria)\ **Post date:** [August 13, 2021, 5:06pm UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/3 "2021-08-13T17:06:29Z")
simple user,, so you suggest that I should switch to root? ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [August 13, 2021, 10:43pm UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/4 "2021-08-13T22:43:38Z")
I would check the roles/permissions and either add the needed privs or switch to another user. ---
**Author:** ![Yves\_Silvere\_Randria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yves_silvere_randria/32/92239_2.png) [@Yves\_Silvere\_Randria](https://discuss.elastic.co/u/Yves_Silvere_Randria)\ **Post date:** [August 16, 2021, 5:29am UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/5 "2021-08-16T05:29:49Z")
Ok,, so where should I check?? Elastic?? logstash??.. where ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 16, 2021, 5:59am UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/6 "2021-08-16T05:59:43Z")
@Yves_Silvere_Randria welcome to the community. Before we get to permissions or anything else because it may not be permissions. Help us understand some basics Basic number one what is your architecture? 1. Suricata logs \> Filebeat-\> Logstash \> Elasticsearch 2. Suricata logs \> Filebeat \> Elasticsearch 3. Suricata logs \> Logstash \> Elasticsearch Let us know then I will have some additional questions. ---
**Author:** ![Yves\_Silvere\_Randria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yves_silvere_randria/32/92239_2.png) [@Yves\_Silvere\_Randria](https://discuss.elastic.co/u/Yves_Silvere_Randria)\ **Post date:** [August 16, 2021, 6:08am UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/7 "2021-08-16T06:08:56Z")
My architecture is 1. Suricata logs \> Filebeat-\> Logstash \> Elasticsearch All of these servers are running in a Debian 10 OS . Suricata + filebeat in one server Logstash in another server Elastc in another ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 16, 2021, 6:16am UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/8 "2021-08-16T06:16:28Z")
Ok so are you using the suricata filebeat module? If so there are certain steps / configuration you need for your architecture... Look at this post by me... It's for ngnix logs but same principles apply.. look at these 2 posts > [@Nginx access and error logs show incorroct value in kibana dashboard](https://discuss.elastic.co/t/nginx-access-and-error-logs-show-incorroct-value-in-kibana-dashboard/269453/8): > > Here is my beats -\> logstash - es conf Pay special attention the the pipeline reference, what is probably happening is the the ingest pipeline (the ngnix ingest pipeline) is not being called, thus the logs are not parse correctly If you first point filebeat at elasticsearch and run filebeat setup -e Then point filebeat to logstash and use this all the ILM, Templates, Pipelines, dashboards etc should work. ################################################ # beats-\>logstash-\>es default … > [@Nginx access and error logs show incorroct value in kibana dashboard](https://discuss.elastic.co/t/nginx-access-and-error-logs-show-incorroct-value-in-kibana-dashboard/269453/10): > > Hi @fati I provided my suggestion... But looks like you are still trying other options. You are making this more complex than it needs to be. You are trying to run set up with all the individual commands that can often lead to issues as opposed to just running the basic command that I supplied so let's try this again. go into elasticsearch and clean up / delete any filebeat indices in your filebeat.yml configure the output to point to elasticsearch. Comment out the logstash output. The … ---
**Author:** ![Yves\_Silvere\_Randria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yves_silvere_randria/32/92239_2.png) [@Yves\_Silvere\_Randria](https://discuss.elastic.co/u/Yves_Silvere_Randria)\ **Post date:** [August 16, 2021, 6:28am UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/9 "2021-08-16T06:28:31Z")
Ok, I'll try , these commands are still working on an ELK 6.8.0 stack?? ---
**Author:** ![Yves\_Silvere\_Randria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yves_silvere_randria/32/92239_2.png) [@Yves\_Silvere\_Randria](https://discuss.elastic.co/u/Yves_Silvere_Randria)\ **Post date:** [August 16, 2021, 6:41am UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/10 "2021-08-16T06:41:52Z")
"3. now go back into your elasticsearch.yml and comment out (or take out) the elasticsearch output and put in your logstash output." Is this elasticsearch.yml file the same as in the elastic server????? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 16, 2021, 1:45pm UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/11 "2021-08-16T13:45:42Z")
Good catch the should be filebeat.yml 6.8 is very old you should upgrade but yes I think this should still all work. The basic point is if you want to use Logs -\> Filebeat -\> Logstash -\> Elasticsearch You need to point filebeat directly at Elasticsearch Initially, then run setup (to load all the Kibana and Elasticsearch assets) then point filebeat to Logstash when you want to ship logs. Setup only needs to be run Once, unless you add a new Module or when you upgrade all the stack versions. ---
**Author:** ![Yves\_Silvere\_Randria](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yves_silvere_randria/32/92239_2.png) [@Yves\_Silvere\_Randria](https://discuss.elastic.co/u/Yves_Silvere_Randria)\ **Post date:** [August 24, 2021, 6:19am UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/12 "2021-08-24T06:19:01Z")
Sorry for the delay, In fact , I am following this tutorial : [GitHub - robcowart/synesis\_lite\_suricata: Suricata IDS/IPS log analytics using the Elastic Stack.](https://github.com/robcowart/synesis_lite_suricata) And I have the problem on the screenshot above ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 24, 2021, 1:50pm UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/13 "2021-08-24T13:50:11Z")
Hi @Yves_Silvere_Randria Apologies, but I am not going to be able to help you much with following that guide, as it is not part of our documentation and it is several years old. I can tell you there is a Suricata Module with Filebeat and I would recommend using that > **[Suricata module | Filebeat Reference \[7.14\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-suricata.html)** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 21, 2021, 3:51pm UTC](https://discuss.elastic.co/t/have-a-problem-with-my-suricata-elk-stack/281364/14 "2021-09-21T15:51:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.