# No data in suricata dashboard **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 18, 2024, 6:14pm UTC](https://discuss.elastic.co/t/no-data-in-suricata-dashboard/351373 "2024-01-18T18:14:13Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![e-ferrari](https://avatars.discourse-cdn.com/v4/letter/e/898d66/32.png) [@e-ferrari](https://discuss.elastic.co/u/e-ferrari)\ **Post date:** [January 18, 2024, 6:14pm UTC](https://discuss.elastic.co/t/no-data-in-suricata-dashboard/351373/1 "2024-01-18T18:14:13Z")
Hi, i'm pretty new to ELK and struggling a lot. I try to read my suricata log with filebeat and visualize it with kibana. But the dashboard is empty: 0 events and "No results found". Suricata is running and constantly updating eve.json. This is my filebeat.yml: ```auto output.elasticsearch: # Array of hosts to connect to. hosts: ["https://elasticsearch.scidom.de:9200"] # Protocol - either `http` (default) or `https`. protocol: "https" # Authentication credentials - either API key or username/password. #api_key: "id:api_key" username: "elastic" password: " ****************" ssl: enabled: true verification_mode: none ## ssl.ca_trusted_fingerprint: "A3:BC:D6:00:25:A5:D2:10:47:C5:C0:3A:C3:70:0C:56:CC:EC:73:B1:A2:64:40:F7:0C:96:C6:96:B9:82:9F:DF" filebeat.config.modules.path: ${path.config}/modules.d/*.yml setup.kibana: host: "http://elasticsearch.scidom.de:5601" ``` I know that these settings are unsecure, it's just a test environment. This is my module configuration: ```auto # Module: suricata # Docs: https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-module-suricata.html - module: suricata # All logs eve: enabled: true # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. var.paths: ["/var/log/suricata/eve.json"] ``` I followed the instructions in Kibana: "Add integration". When i choose on the webpage with the instructions "Check data", it says "Data successfully received from this module". But i don't see anything in kibana. Any help is appreciated. Bernd ---
**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\ **Post date:** [January 19, 2024, 7:55am UTC](https://discuss.elastic.co/t/no-data-in-suricata-dashboard/351373/2 "2024-01-19T07:55:29Z")
Hi, Check the Kibana index pattern: Make sure that the index pattern you're using in Kibana matches the indices where Filebeat is sending the Suricata logs. Regards ---
**Author:** ![e-ferrari](https://avatars.discourse-cdn.com/v4/letter/e/898d66/32.png) [@e-ferrari](https://discuss.elastic.co/u/e-ferrari)\ **Post date:** [January 19, 2024, 5:25pm UTC](https://discuss.elastic.co/t/no-data-in-suricata-dashboard/351373/3 "2024-01-19T17:25:22Z")
Hi, thanks for your answer. I found out the index where the data is sent but how can i find out the index kibana uses ? I also found this: `.ds-filebeat-8.11.3-2024.01.17-000001 0 r UNASSIGNED CLUSTER_RECOVERED` My index has just one replica shard and is not assigned. I think that's not correct. Can i change the type of the shard to primary? How ? And how can i assign it ? It's just a testing environment and i have only one elastic node. Bernd ---
**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\ **Post date:** [January 19, 2024, 9:40pm UTC](https://discuss.elastic.co/t/no-data-in-suricata-dashboard/351373/4 "2024-01-19T21:40:30Z")
> [@e-ferrari](#): > > I found out the index where the data is sent but how can i find out the index kibana uses ? > I also found this: > `.ds-filebeat-8.11.3-2024.01.17-000001 0 r UNASSIGNED CLUSTER_RECOVERED` > My index has just one replica shard and is not assigned. I think that's not correct. > Can i change the type of the shard to primary? How ? > And how can i assign it ? It's just a testing environment and i have only one elastic node. Hi, Elasticsearch tries to place the primary and replica shards on different nodes for redundancy. But since you have only one node, it can't assign the replica shard. To remove the replica shard, you can update the number of replicas to 0 for your index: ```auto PUT //_settings { "number_of_replicas": 0 } ``` As for finding out the index Kibana uses, it depends on the visualization or dashboard you're looking at. In most cases, you would select the index when creating the visualization or dashboard. If you're not sure, you can check the settings of the visualization or dashboard in Kibana. Regards ---
**Author:** ![e-ferrari](https://avatars.discourse-cdn.com/v4/letter/e/898d66/32.png) [@e-ferrari](https://discuss.elastic.co/u/e-ferrari)\ **Post date:** [January 20, 2024, 11:18am UTC](https://discuss.elastic.co/t/no-data-in-suricata-dashboard/351373/5 "2024-01-20T11:18:17Z")
Hi, i set the replicas to zero and now it's going fine. Thanks. Bernd ---
**Author:** ![e-ferrari](https://avatars.discourse-cdn.com/v4/letter/e/898d66/32.png) [@e-ferrari](https://discuss.elastic.co/u/e-ferrari)\ **Post date:** [January 22, 2024, 10:09pm UTC](https://discuss.elastic.co/t/no-data-in-suricata-dashboard/351373/6 "2024-01-22T22:09:34Z")
Unfortunately it's not fine anymore. Replicas still zero, cluster green, but i don't see any data in the dashboard from suricata. Suricate is running and permanently writing events. I see the events in Kibana under "Analytics ==\> Discover", but the dashboard is empty. "filebeat setup" on the suricata host ran fine. ---
**Author:** ![yago82](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yago82/32/97755_2.png) [@yago82](https://discuss.elastic.co/u/yago82)\ **Post date:** [January 23, 2024, 4:56pm UTC](https://discuss.elastic.co/t/no-data-in-suricata-dashboard/351373/7 "2024-01-23T16:56:11Z")
> [@e-ferrari](#): > > Unfortunately it's not fine anymore. > Replicas still zero, cluster green, but i don't see any data in the dashboard from suricata. Suricate is running and permanently writing events. I see the events in Kibana under "Analytics ==\> Discover", but the dashboard is empty. > "filebeat setup" on the suricata host ran fine. Hi, If there are any filters or queries applied to the Dashboard or its visualizations, make sure they match your data. Check the field you use in the visualization might not exist in your data or might contain different values than expected. Regards ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 20, 2024, 6:56pm UTC](https://discuss.elastic.co/t/no-data-in-suricata-dashboard/351373/8 "2024-02-20T18:56:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.