# I didnt get suricata eve.json

**URL:** <https://discuss.elastic.co/t/i-didnt-get-suricata-eve-json/193058>\
**Category:** Kibana\
**Created:** [July 31, 2019, 7:43am UTC](https://discuss.elastic.co/t/i-didnt-get-suricata-eve-json/193058 "2019-07-31T07:43:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jiangyanjun](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jiangyanjun](https://discuss.elastic.co/u/jiangyanjun)\
**Post date:** [July 31, 2019, 7:43am UTC](https://discuss.elastic.co/t/i-didnt-get-suricata-eve-json/193058/1 "2019-07-31T07:43:45Z")

</div>

kibana 7.2 elasticsearch 7.2 filebeat 6.7.2

filebeat modules enable suricata

suricata.yaml

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4bf0cdb95902988e288997a1ee1fbf1b706da626.png)

filebeat.yml

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/4/546124338630305a1a90d2e0a9e42402fe14c438.png)

filebeat -e -d "publish"

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/1/71f5da52ac82b87a2d72aa8a9285cd91a24f6efb.png)

we can see that the content of eve.json has read out, but can not display in kibana

can anyone help me?

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [July 31, 2019, 6:28pm UTC](https://discuss.elastic.co/t/i-didnt-get-suricata-eve-json/193058/2 "2019-07-31T18:28:30Z")

</div>

A couple things to begin debugging - we need to first figure out if the data is making it into Elasticsearch.

What is the output of `GET /_cat/indices` [(docs)](https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-indices.html)

Check the filebeat logs for errors. Where these logs are depends on how you have installed Filebeat. If you need assistance with this let me know the OS and how you install Filebeat.

Looking at your config, I wonder if there are issues, as with`eve-log.enabled: yes`. This should be a boolean value, `true`. Additionaly, the comment for `filetype` gives some possible values, but you have a value of `file` which is not provided as an option. Maybe you want `regular`? The Beats topic could probably assist you more with that.

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [July 31, 2019, 6:38pm UTC](https://discuss.elastic.co/t/i-didnt-get-suricata-eve-json/193058/3 "2019-07-31T18:38:45Z")

</div>

Some additional information from @HaranKumar:

- When the module is enabled, there is no need to define the path in filebeat.yml
- Add the path within the suricata module file inside the module folder.
- Run “filebeat setup”

---

<div class="post-metadata">

**Author:** ![jiangyanjun](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jiangyanjun](https://discuss.elastic.co/u/jiangyanjun)\
**Post date:** [August 1, 2019, 12:55am UTC](https://discuss.elastic.co/t/i-didnt-get-suricata-eve-json/193058/4 "2019-08-01T00:55:49Z")

</div>

Thank you for you answer  
The third picture is the output of "filebeat -e -D "pubulish" "

The output of curl 'localhost:9200/\_cat/indices?v'

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d38fd1256bffaceb94318a5c97fa423fe9d00103.png)

the output of curl 'localhost:9200/filebeat-6.7.2-2019.07.31/\_search?q=\*&pretty'

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/6/767fb00020c5a32a7bc20c05787fe0c339beb917.png)

elasticsearch has received the eve.log content

---

<div class="post-metadata">

**Author:** ![jiangyanjun](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jiangyanjun](https://discuss.elastic.co/u/jiangyanjun)\
**Post date:** [August 1, 2019, 5:50am UTC](https://discuss.elastic.co/t/i-didnt-get-suricata-eve-json/193058/5 "2019-08-01T05:50:53Z")

</div>

now i can get the eve.json on kibana ,thanks all.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2019, 5:50am UTC](https://discuss.elastic.co/t/i-didnt-get-suricata-eve-json/193058/6 "2019-08-29T05:50:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.