Mapping flow logs with ES

Elastic Stack Beats
1

I am trying to send aws vpc flow logs from S3 to Elasticsearch by filebeats. Can anyone tell me how the mapping of fields is happening? I understand it takes the reference of elastic schema. But i still have the following questions.

  1. S3 bucket can contain cloudtrail or vpcflow logs or my own app logs. How file beat interprets what kind of logs are there in S3.
  2. Once filebeat knows what logs it is dealing with, does it have intelligence to maps the related fields in Elasticsearch.
  3. What is the documentation on exported fields trying to convey?
    s3 fields | Filebeat Reference [8.8] | Elastic
    AWS fields | Filebeat Reference [8.8] | Elastic
  4. I see that the actual content of flow logs is tagged to field "message" in elasticsearch. Then what is the purpose of below url:
    Amazon VPC | Elastic docs

Thanks
Nish

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.