Search for IP address does not return results

Elastic Stack Kibana
1

I'm trying to search for an IP (example query on search page: 127.0.0.1) in the filebeat-* index, and the results indicate 0. If I put *.ip:127.0.0.1 it works fine (I get results with desintation and source IPs). Appears to be the same with KQL or lucene.

My concern and question is, shouldn't kibana be searching all fields if I don't specify one? I'm running kibana 7.6.1.

2

Hello

Thanks for your question. By default if you are not having any search criteria in the search bar, it shows the data polled for the last hour. I just installed sample data and saw this.

Screen Shot 2020-04-23 at 10.31.36 AM
Screen Shot 2020-04-23 at 10.31.36 AM3356×1158 398 KB
Is that what you see ?

Thanks
Rashmi

3

It's not an issue with the time range.

4

I believe the issue is that the various source.ip/destination.ip fields are not listed in the filebeat template query defaul_field list. I'm not sure why though.

5

Relevant issues -


6

Thanks for posting those links, really helpful. Also copying our infra docker expert @jarpy for more insights into this. He will get back to you when he has some time.

Thanks
Rashmi

7

It's a little bit out of my domain, by I think that @opoplawski is on the right track with those issues. We should see if we can get the Beats team to address them.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.