I am just trying to get some custom data into SIEM using Logstash reading a csv file. I have no trouble getting the data into Elastic Search but it does not show up in the SIEM dashboard. Even after I add the index under the default index for SIEM.
I think where I am going wrong is my data is not being mapped to the ECS. How would I go about mapping data to the ECS using logstash and reading in a csv file?