Have a problem with my Suricata + ELK stack

[stephenb (Stephen Brown)]

Ok so are you using the suricata filebeat module?

If so there are certain steps / configuration you need for your architecture... Look at this post by me...

It's for ngnix logs but same principles apply.. look at these 2 posts

Nginx access and error logs show incorroct value in kibana dashboard

Here is my beats -> logstash - es conf Pay special attention the the pipeline reference, what is probably happening is the the ingest pipeline (the ngnix ingest pipeline) is not being called, thus the logs are not parse correctly If you first point filebeat at elasticsearch and run filebeat setup -e Then point filebeat to logstash and use this all the ILM, Templates, Pipelines, dashboards etc should work. ################################################ # beats->logstash->es default …

Nginx access and error logs show incorroct value in kibana dashboard

Hi @fati I provided my suggestion... But looks like you are still trying other options. You are making this more complex than it needs to be. You are trying to run set up with all the individual commands that can often lead to issues as opposed to just running the basic command that I supplied so let's try this again. go into elasticsearch and clean up / delete any filebeat indices in your filebeat.yml configure the output to point to elasticsearch. Comment out the logstash output. The …