stephenb
August 21, 2021, 5:36am
7
Looks like you did not run setup.
setup sets up the correct mappings, ingest pipeline etc.
Hopefully your are following the steps closely in the Quick start guide
Setup see here
Auditbeat Quick start guide here
If you do not run setup your mappings will not be correct which is what your issue looks like to me.
Also if you Architecture is
Auditbeat > Logstash > Elasticsearch you need to follow this process.
This example is metricbeat but same process
Hi @jthart Welcome to the community apologies that you're having some struggles getting this set up Perhaps we can help.
Assuming you want to run an architecture like this
Metricbeat (1 to Many) -> Logstash -> Elasticsearch
Basically using Logstash as a collect and pass through
Here is my recommendation try to resist the urge to make this more complex. Do not try to manually load index templates dashboards anything else follow the quick start / basic setup.
Clean everything up we're star…
Also I would get
Auditbeat > Elasticsearch working first then introduce Logstash