Hi there, I have upgraded to 7.9 across the board and syslog events aren't showing up in security as they previously did in SEIM. I am bringing these in via Logstash with a config file that reformats them, and I can see these records imported succesfully in Elastic - I have added a Kibana index fo…

Hi @finbarr996 , What I think is going on is if you go to: Stack management / Advanced settings And look for the defaultIndex pattern for security solutions like below: [Screen Shot 2020-09-01 at 11.33.31 AM] Check to see if you have an extra \ somewhere like my replicated version. In my replic…

Syslog events from Watchguard firewall not appearing

Elastic Security

Frank_Hassanabad (Frank Hassanabad) September 1, 2020, 5:39pm 2

Hi @finbarr996,

What I think is going on is if you go to:

Stack management / Advanced settings

And look for the defaultIndex pattern for security solutions like below:

Check to see if you have an extra \ somewhere like my replicated version. In my replicated version I end up with the same type of errors you are seeing:

Topic		Replies	Views
Set Elastic Security rules on syslog SIEM	3	1432	November 29, 2021
Include custom Elasticsearch index in SIEM default dashboards SIEM	15	2242	August 4, 2020
After applied the tutorial "Getting start with Elasticsearch security" Logstash receive Syslog data but Kibana can’t show it Logstash elastic-stack-security	4	380	December 28, 2020
Recieves Syslogdata, but not visibel in Kibana Logstash	5	372	April 3, 2017
How to ingest firewall log data to elastic security Elastic Security	3	1114	February 28, 2023

Syslog events from Watchguard firewall not appearing

Related topics