# How do I adding Suricata events to Elasticsearch

**URL:** <https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827>\
**Category:** SIEM\
**Created:** [April 5, 2024, 2:10am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827 "2024-04-05T02:10:39Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 5, 2024, 2:18am UTC](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827/2 "2024-04-05T02:18:01Z")

</div>

Hi @rayobe4014 Welcome to the community...

Perhaps take a look at the following

Filebeat quickstart just substitute the suricata module... follow the steps exactly

> **[Filebeat quick start: installation and configuration | Filebeat Reference...](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html)**

The module

> **[Suricata module | Filebeat Reference \[8.13\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-suricata.html)**

Some help here

> [@Filebeat Suricata Module "module suricata is configured but has no enabled filesets"](https://discuss.elastic.co/t/filebeat-suricata-module-module-suricata-is-configured-but-has-no-enabled-filesets/329954):
>
> I'm running filebeat 8.6.2. I initially had it grabbing /var/log/remote.log and it worked fine. Then I enabled the suricata module and set the configuration to this (excluding the output.elasticsearch section): filebeat.inputs: - type: log paths: - /var/log/remote.log processors: - add\_host\_metadata: ~ - add\_cloud\_metadata: ~ - syslog: field: message format: auto ignore\_missing: false ignore\_failure: false filebeat.mod…

---

_[View the full topic](https://discuss.elastic.co/t/how-do-i-adding-suricata-events-to-elasticsearch/356827)._