I didnt get suricata eve.json

Elastic Stack Kibana
1

kibana 7.2 elasticsearch 7.2 filebeat 6.7.2

filebeat modules enable suricata

suricata.yaml

image
image.png872×513 17 KB

filebeat.yml

image
image.png882×300 7.6 KB

filebeat -e -d "publish"

image
image.png1919×562 15.3 KB

we can see that the content of eve.json has read out, but can not display in kibana

can anyone help me?

2

A couple things to begin debugging - we need to first figure out if the data is making it into Elasticsearch.

What is the output of GET /_cat/indices (docs)

Check the filebeat logs for errors. Where these logs are depends on how you have installed Filebeat. If you need assistance with this let me know the OS and how you install Filebeat.

Looking at your config, I wonder if there are issues, as witheve-log.enabled: yes. This should be a boolean value, true. Additionaly, the comment for filetype gives some possible values, but you have a value of file which is not provided as an option. Maybe you want regular? The Beats topic could probably assist you more with that.

3

Some additional information from @HaranKumar:

  • When the module is enabled, there is no need to define the path in filebeat.yml
  • Add the path within the suricata module file inside the module folder.
  • Run “filebeat setup”
4

Thank you for you answer
The third picture is the output of "filebeat -e -D "pubulish" "

The output of curl 'localhost:9200/_cat/indices?v'

image
image.png1008×107 5.55 KB

the output of curl 'localhost:9200/filebeat-6.7.2-2019.07.31/_search?q=*&pretty'

image
image.png1918×751 19.1 KB

elasticsearch has received the eve.log content

5

now i can get the eve.json on kibana ,thanks all.