MISP Configuration issue in Filebeat module

Error while processing http request: failed to execute http client.Do: failed to execute http client.Do: Post "https://127.0.0.1/events/restSearch": POST https://127.0.0.1/events/restSearch giving up after 6 attempts {"id": "4A96BE5284B83AD6", "input_source": "https://127.0.0.1/events/restSearch", "input_url": "https://127.0.0.1/events/restSearch"}

Configuration:

  misp:
    enabled: true

    # Input used for ingesting threat intel data, defaults to JSON.
    var.input: httpjson

    # The URL of the MISP instance, should end with "/events/restSearch".
    var.url: "https://127.0.0.1/events/restSearch"

    # The authentication token used to contact the MISP API. Found when looking at user account in the MISP UI.
    var.api_token: API KEY

    # Configures the type of SSL verification done, if MISP is running on self signed certificates
    # then the certificate would either need to be trusted, or verification_mode set to none.
    var.ssl.verification_mode: none

    # Optional filters that can be applied to the API for filtering out results. This should support the majority of fields in a MISP context.
    # For examples please reference the filebeat module documentation.
    #var.filters:
    #  - threat_level: [4, 5]
    #  - to_ids: true

    # How far back to look once the beat starts up for the first time, the value has to be in hours. Each request afterwards will filter on any event newer
    # than the last event that was already ingested.
    var.first_interval: 300h

    # The interval to poll the API for updates.
    var.interval: 5m```


MISP and Filebeat are both installed on the same machine. On the MISP dashboard, I am unable to see any data.
Could you please walk me through the entire process, from MISP setting to Filebeat? I'd like to double-check this, and I'll have to fix this problem as well.
Please accept my heartfelt gratitude in advance.

MISP and Filebeat are both installed on the same machine. On the MISP dashboard, I am unable to see any data.
Could you please walk me through the entire process, from MISP setting to Filebeat? I'd like to double-check this, and I'll have to fix this problem as well.
Please accept my heartfelt gratitude in advance.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.