How to Change Default Index Pattern on Filebeat dashboards on Kibana

[nunex_17 (Noob17)]

Hi.

I am having a hard time trying to figure this out. I changed the default index name to suricata-ids.

Also, added this line in order to use this new index on the default dashboards.

But still, default dashboards are pointing to filebeat index.

[stephenb (Stephen Brown)]

Did you clean out the old dashboards and the run setup again.

[nunex_17 (Noob17)]

Yes, already did that again

[stephenb (Stephen Brown)]

Interesting this is not working for me either.... even when I clean out and run setup.

This seems like a bug... perhaps you could file a bug report.

What I did do ... and you can for a workaround is

edit the visualizations jsons from the filebeat directory

kibana/7/dashboard/filebeat-suricata-alert-overview.json
kibana/7/dashboard/filebeat-suricata-event-overview.json

And replace the filebeat-* with your suricata-ids-*

That seems to work for me. Obviously this is a work around.

Also Please don't post screenshots of text some people can not read it and it can not be searched on nor can we cut-n-paste to test.

Note : I asked a question internally as well.

[nunex_17 (Noob17)]

Thank you!

Problem solved. I will file a bug report