Hello,
I'm having a problem with the threatintel misp module of filebeat (v7.19.29):
when a MISP event contains one or more objects, the number of documents in elasticsearch is the product of the number of simple attributes and the number of the attributes in the object(s).
For example, a simple test event with 5 attributes (3 "plain", 2 in an object):
is ingested as 6 documents:
Here the links to MISP event: misp event and the elastic documents: elastic docs.
I'd expect to find 5 documents in Elastic.
Have anyone any suggestion, or found the same problem?
Thank you in advance,
Paolo Arosio