# Threatintel module filebeat **URL:** \ **Category:** Elastic Security\ **Created:** [November 1, 2022, 3:09am UTC](https://discuss.elastic.co/t/threatintel-module-filebeat/317858 "2022-11-01T03:09:38Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![emmanuel\_stevens\_LED](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emmanuel_stevens_led/32/107869_2.png) [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Post date:** [November 1, 2022, 3:09am UTC](https://discuss.elastic.co/t/threatintel-module-filebeat/317858/1 "2022-11-01T03:09:38Z")
Hello, I activate the theatintel module for filebeat but still doesn t get any datas ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04302b1b5ea2b8eb4273fb14bf43600d847e3a23.png) i have this in my logs ''' Nov 1 03:00:02 hostname filebeat[560069]: {"log.level":"info","@timestamp":"2022-11-01T03:00:02.308Z","log.logger":"input.httpjson-stateless","log.origin":{"file.name":"httpjson/request.go","file.line":397},"message":"request finished: 1000 events published","service.name":"filebeat","id":"theid","input\_url":"[https://urlhaus-api.abuse.ch/v1/payloads/recent/","ecs.version":"1.6.0](https://urlhaus-api.abuse.ch/v1/payloads/recent/%22,%22ecs.version%22:%221.6.0)"} ''' I do not see the datas or any dashborad. Can you help please, i am new to this part of the app ---
**Author:** ![emmanuel\_stevens\_LED](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emmanuel_stevens_led/32/107869_2.png) [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Post date:** [November 12, 2022, 5:50pm UTC](https://discuss.elastic.co/t/threatintel-module-filebeat/317858/2 "2022-11-12T17:50:39Z")
Hello, Now i can see the threat intelligence data. I can even inspect the sources . i am using ECK with logstash and kafka. I already have the filebeat dashboard overview display. It is only this dashborad that i do not have ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9bff37ac8dba4a4dcde6e355ec1e3b9f3577673.png) but no dashboard in htreat intelligence overview. I do not know how to make them display. Please Help ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b506b0ad09dfc54e5c7b115b1dbd0c4d9213f3d1.png) ---
**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\ **Post date:** [November 12, 2022, 10:17pm UTC](https://discuss.elastic.co/t/threatintel-module-filebeat/317858/3 "2022-11-12T22:17:02Z")
Hi, man! I saw an issue like this in Elastic security version 7.16. Have you tried checking space Security permissions? Check if a variable is set to true and without the # in filebeat.yml `setup.dashboards.enabled: true` ---
**Author:** ![emmanuel\_stevens\_LED](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emmanuel_stevens_led/32/107869_2.png) [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Post date:** [November 13, 2022, 1:13am UTC](https://discuss.elastic.co/t/threatintel-module-filebeat/317858/4 "2022-11-13T01:13:29Z")
HI @wsouza , I tried what you said but i doesnt resolve the problem, Thank you for your hlep ---
**Author:** ![maxcold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxcold/32/97686_2.png) [@maxcold](https://discuss.elastic.co/u/maxcold)\ **Post date:** [November 15, 2022, 11:39am UTC](https://discuss.elastic.co/t/threatintel-module-filebeat/317858/5 "2022-11-15T11:39:58Z")
hi @emmanuel_stevens_LED , the Threat Intelligence Overview dashboard from the Threat Intelligence Utils package only supports Elastic Agent Threat Intelligence integrations and doesn't support Filebeat integrations. But you can edit this dashboard to start showing the data coming from the filebeat integrations. You need to specify the correct index pattern (filebeat-\* in your case) and adjust the filtering. Here is an example of how it might look like ![Screenshot 2022-11-15 at 12.34.15](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e11f2ad73f25ef83248bb2ade9c112d5a3f98de8.jpeg) ---
**Author:** ![emmanuel\_stevens\_LED](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emmanuel_stevens_led/32/107869_2.png) [@emmanuel\_stevens\_LED](https://discuss.elastic.co/u/emmanuel_stevens_LED)\ **Post date:** [November 18, 2022, 2:02am UTC](https://discuss.elastic.co/t/threatintel-module-filebeat/317858/6 "2022-11-18T02:02:13Z")
Hello, i have a configuration of; (beats,kafka,logstash,elastic,kibana) in that order. I see that the elastic agent does not support kafka output, what solution you can point me to. Will it work if i add a logstash before the kafka . so i can have a config like ( agent, logstash, kafka,logstash,elastic,kibana). Would that last configuration provide the threat dashboard ? ---
**Author:** ![maxcold](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maxcold/32/97686_2.png) [@maxcold](https://discuss.elastic.co/u/maxcold)\ **Post date:** [November 18, 2022, 4:25pm UTC](https://discuss.elastic.co/t/threatintel-module-filebeat/317858/7 "2022-11-18T16:25:07Z")
@emmanuel_stevens_LED it's hard to give advice without the details of your requirements. I'm not sure why you need Kafka and Logstash in front of the beats. As beats and Elastic Agent can ingest directly into Elasticsearch, by default you shouldn't need Kafka and Logstash to get the data from them into Elasticsearch. For the dashboard to work you either need the Threat Intelligence data stored in `logs-*` index (Elastic Agent Threat Intelligence integrations by default store the data in `logs-ti_*` indexes), or edit the dashboard so that the lenses in this dashboard use the index where you currently store the Threat Intelligence data ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 16, 2022, 4:25pm UTC](https://discuss.elastic.co/t/threatintel-module-filebeat/317858/8 "2022-12-16T16:25:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.