Osquery exported fields

Elastic Security
1

I'm running 7.16.1 for everything.
including elastic-agent-7.16.1-linux-x86_64.tar.gz

I have a question on osquery exported fields.
From this URL: Osquery Manager | Elastic Docs
It states that fields like
interface_details.ibytes should be mapped as ibytes, "keyword, number.long"

When I imported it via fleet, osquery packs. With a simple
id: interface_details
interval: 60
query: select * from interface_details;

From the kibana gui on the retrieved data.
All the osquery.idrops , ipackets etc are mapped as text fields.

I thought it was suppose to be mapped as number.long?
Or am I missing something?

Regards,

Michael

2

Sorry.. my mistake.. apparently when you visualise you actually see the value as
osquery.ibytes
osquery.ibytes.number

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.