# MISP data in elasticsearch (filebeat)

**URL:** <https://discuss.elastic.co/t/misp-data-in-elasticsearch-filebeat/279489>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [July 23, 2021, 2:00pm UTC](https://discuss.elastic.co/t/misp-data-in-elasticsearch-filebeat/279489 "2021-07-23T14:00:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zuzusa](https://avatars.discourse-cdn.com/v4/letter/z/71c47a/32.png) [@zuzusa](https://discuss.elastic.co/u/zuzusa)\
**Post date:** [July 23, 2021, 2:00pm UTC](https://discuss.elastic.co/t/misp-data-in-elasticsearch-filebeat/279489/1 "2021-07-23T14:00:38Z")

</div>

Hi together,

I am currently using a MISP in combination with elasticsearch. My goal is to have all events from the MISP also within elasticsearch.

Currently the import of the MISP events to the elasticsearch is done via a filebeat (modules.d/misp). Generally the transfer of the MISP events seems to work well.

However, there is one problem: It seems that the filebeat does not transfer the historical events (the ones that were already present in the MISP before the start). So only events that run into the MISP when the filebeat is active are transferred.

Is there a possibility to transfer all data from the MISP?

Thanks,

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [July 26, 2021, 11:23am UTC](https://discuss.elastic.co/t/misp-data-in-elasticsearch-filebeat/279489/2 "2021-07-26T11:23:25Z")

</div>

Hi!

I don't see any configuration setting that could provide that option. Could you open a GH issue for this enhancement request so as to have the team evaluate this feature?

C.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2021, 11:24am UTC](https://discuss.elastic.co/t/misp-data-in-elasticsearch-filebeat/279489/3 "2021-08-23T11:24:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.