Reading Wazuh data from kafka, write to Elasticsearch using Filebeat and pipeline

Elastic Stack Beats
1

Hi, community. I want to read Wazuh data from kafka and write it to Elasticsearch.
All way looks like: wazuh-manager->filebeat->logstash->nifi->kafka_>filebeat->elasticsearch.
I try to write to elasticsearch using native wazuh pipeline for filebeat, but it doesn't write to elasticsearch anything.
Trying to write data from kafka, wazuh plugin disabled, pipeline is created:

изображение
изображение716×154 4.27 KB

Results:
изображение
изображение1203×140 5.92 KB

Writing to elasticsearch when wazuh plugin enabled, data path looks like wazuh-manager->filebeat->elasticsearch:

изображение
изображение715×141 4.11 KB

Results:
изображение
изображение1236×170 9.64 KB

Why pipeline doesn't work in first case? What I am doing wrong?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.