I am currently using a MISP in combination with elasticsearch. My goal is to have all events from the MISP also within elasticsearch.
Currently the import of the MISP events to the elasticsearch is done via a filebeat (modules.d/misp). Generally the transfer of the MISP events seems to work well.
However, there is one problem: It seems that the filebeat does not transfer the historical events (the ones that were already present in the MISP before the start). So only events that run into the MISP when the filebeat is active are transferred.
Is there a possibility to transfer all data from the MISP?