Unable to fetch custom indices data in ECS

Elastic Security
1

If i add my custom indices in data sources on elastic security
then how should i map field in ecs

2

Hey there @aditi_salunke -- welcome to the community! :wave:

So when adding custom indices you'll want to use the Elastic Security ECS field reference as a guide for what fields are used in Elastic Security, and for help with the mapping I highly recommend checking out this blog post (for beats), this webinar for both beats/external events and the ecs-mapper tool.

Hope this is helpful, and look forward to hearing your feedback in using Elastic Security! :slightly_smiling_face:

Cheers!
Garrett

3

hi @spong thanks for the help. :slightly_smiling_face:

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.