Is it possible to obtain a file creation date via Filebeat?

Is it possible to obtain a file creation date via Filebeat?

I would like to get this field to include as object of metadata in elastic.

Hey @Guerreiro_Sousa, welcome to discuss :slightly_smiling_face:

I think it is not possible to obtain this data with Filebeat, but maybe you can give a try to the file_integrity module of Auditbeat: https://www.elastic.co/guide/en/beats/auditbeat/7.6/auditbeat-module-file_integrity.html
It monitors changes on files, and it includes the creation time on the events. It can do a initial scan to collect the initial state of all the monitored files.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.