Iptables module not working - filebeat or elastic?

Elastic Stack Beats
2

Resolved.

This offered insight: Filebeat Iptables Overview / No results found

  • /var/log/iptables.log must contain ONLY log entries of iptables format.
  • It may be necessary to remove /var/lib/filebeat/registry (or rename to registry.bk) and restart filebeat
  • To isolate logging from specific source with rsyslog:
    /etc/rsyslog.d/00-iptables.conf:
if $fromhost-ip=='192.168.1.1' then /var/log/iptables.log
& ~