Hello, new to Filebeat. I have a simplified case working: Suricata to Filebeat to Kafka if I hard code one kafka topic name in filebeat.yml. But I'd like to make Filebeat dynamically route events to different topics based on their Suricata event type.
I've taken several wild guesses, but I don't really understand how dynamic filebeat fields work, or what I need to do to set them up. Here's one attempt after enabling the suricata module:
The filebeat log just gives me this:
2020-01-14T23:44:49.550Z INFO kafka/log.go:53 kafka message: Initializing new client 2020-01-14T23:44:49.551Z INFO kafka/log.go:53 kafka message: Successfully initialized new client 2020-01-14T23:44:49.551Z INFO pipeline/output.go:105 Connection to kafka(somehost:9092) established 2020-01-14T23:44:49.551Z ERROR kafka/client.go:144 Dropping event: no topic could be selected 2020-01-14T23:44:49.551Z ERROR kafka/client.go:144 Dropping event: no topic could be selected
Is this kind of thing possible with filebeat, and if so how? An example would be ideal.