# Sysmon kibana integration **URL:** \ **Category:** Kibana\ **Created:** [July 21, 2019, 9:06pm UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541 "2019-07-21T21:06:40Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![bilge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bilge/32/46821_2.png) [@bilge](https://discuss.elastic.co/u/bilge)\ **Post date:** [July 21, 2019, 9:06pm UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/1 "2019-07-21T21:06:40Z")
Hi, I'm trying to send sysmon logs to kibana. I've managed to visualize Kibana. But the schema is not displayed properly. Therefore, I cannot filter. Would you help if I need to create a schema for sysmon in the Kibana section? I use it as an ELK. > **[philhagen/sof-elk](https://github.com/philhagen/sof-elk)** > > Configuration files for the SOF-ELK VM, used in SANS FOR572 - philhagen/sof-elk ![Screenshot_1](https://us1.discourse-cdn.com/elastic/original/3X/8/c/8cf33868feed0931f9f2b4d928215037fbcbf3d7.png) ---
**Author:** ![LizaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizad/32/51074_2.png) [@LizaD](https://discuss.elastic.co/u/LizaD)\ **Post date:** [July 22, 2019, 3:27pm UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/2 "2019-07-22T15:27:05Z")
Hi @bilge, How are you getting the data into Elasticsearch, are you using winlogbeat? Thanks, Liza ---
**Author:** ![philhagen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/philhagen/32/96548_2.png) [@philhagen](https://discuss.elastic.co/u/philhagen)\ **Post date:** [July 22, 2019, 3:46pm UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/3 "2019-07-22T15:46:08Z")
just a clarification that OP is @bilge, not me. It seems he's using my SOF-ELK VM, though. ---
**Author:** ![LizaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizad/32/51074_2.png) [@LizaD](https://discuss.elastic.co/u/LizaD)\ **Post date:** [July 22, 2019, 3:47pm UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/4 "2019-07-22T15:47:20Z")
Ah thanks Phil, sorry for my mixup 🙂 ---
**Author:** ![bilge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bilge/32/46821_2.png) [@bilge](https://discuss.elastic.co/u/bilge)\ **Post date:** [July 22, 2019, 8:45pm UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/5 "2019-07-22T20:45:29Z")
I am using nxlog. Does nxlog or winlogbeat matter? ---
**Author:** ![LizaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizad/32/51074_2.png) [@LizaD](https://discuss.elastic.co/u/LizaD)\ **Post date:** [July 22, 2019, 9:00pm UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/6 "2019-07-22T21:00:38Z")
Hi @bilge, You can use either I just was trying to narrow down the source. I think you will need a template, from the examples I see forwarding logs to logstash. [https://nxlog.co/documentation/nxlog-user-guide/elasticsearch.html](https://nxlog.co/documentation/nxlog-user-guide/elasticsearch.html) Does this help? Thanks, Liza ---
**Author:** ![bilge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bilge/32/46821_2.png) [@bilge](https://discuss.elastic.co/u/bilge)\ **Post date:** [July 22, 2019, 9:15pm UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/7 "2019-07-22T21:15:18Z")
I have an nxlog configuration file. I send logs directly to logstash. But I need a schema for sysmon logs. Need to edit logstash.conf? or where can I create a conf file in elk for sysmon? ---
**Author:** ![LizaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizad/32/51074_2.png) [@LizaD](https://discuss.elastic.co/u/LizaD)\ **Post date:** [July 22, 2019, 9:34pm UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/8 "2019-07-22T21:34:25Z")
Yes please do edit logstash.conf, it should reload with new pipeline automatically with your new changes. ---
**Author:** ![LizaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizad/32/51074_2.png) [@LizaD](https://discuss.elastic.co/u/LizaD)\ **Post date:** [July 22, 2019, 10:59pm UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/9 "2019-07-22T22:59:48Z")
Here is some additional info from @yaauie : Use the [JSON Filter Plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html) to parse the JSON-encoded value held in the event’s `message` field, either expanding it to top-level of the event or injecting the fields as sub-fields. ---
**Author:** ![bilge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bilge/32/46821_2.png) [@bilge](https://discuss.elastic.co/u/bilge)\ **Post date:** [July 24, 2019, 6:31am UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/10 "2019-07-24T06:31:29Z")
there are many template files. I wasn't sure which one I had to edit. Is the path to the logstash.conf file different in sof-elk vm? @philhagen ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 21, 2019, 6:31am UTC](https://discuss.elastic.co/t/sysmon-kibana-integration/191541/11 "2019-08-21T06:31:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.