Error while processing http request: failed to execute http client.Do: failed to execute http client.Do: Post "https://127.0.0.1/events/restSearch": POST https://127.0.0.1/events/restSearch giving up after 6 attempts {"id": "4A96BE5284B83AD6", "input_source": "https://127.0.0.1/events/restSearch", "input_url": "https://127.0.0.1/events/restSearch"}
Configuration:
misp:
enabled: true
# Input used for ingesting threat intel data, defaults to JSON.
var.input: httpjson
# The URL of the MISP instance, should end with "/events/restSearch".
var.url: "https://127.0.0.1/events/restSearch"
# The authentication token used to contact the MISP API. Found when looking at user account in the MISP UI.
var.api_token: API KEY
# Configures the type of SSL verification done, if MISP is running on self signed certificates
# then the certificate would either need to be trusted, or verification_mode set to none.
var.ssl.verification_mode: none
# Optional filters that can be applied to the API for filtering out results. This should support the majority of fields in a MISP context.
# For examples please reference the filebeat module documentation.
#var.filters:
# - threat_level: [4, 5]
# - to_ids: true
# How far back to look once the beat starts up for the first time, the value has to be in hours. Each request afterwards will filter on any event newer
# than the last event that was already ingested.
var.first_interval: 300h
# The interval to poll the API for updates.
var.interval: 5m```
MISP and Filebeat are both installed on the same machine. On the MISP dashboard, I am unable to see any data.
Could you please walk me through the entire process, from MISP setting to Filebeat? I'd like to double-check this, and I'll have to fix this problem as well.
Please accept my heartfelt gratitude in advance.