What should I set "Document to index" so that the index connector write content of source log to index?

Elastic Security
1

There is a log with field "winlog.logon.failure.sub_status" and content is "User logon with misspelled or bad password"

Refer to Index connector and action | Kibana Guide [8.15] | Elastic
I created a rule that using index connector and setting of "Document to index" is:

{
  "failedreason": "{{winlog.logon.failure.sub_status}}"
}

"failedreason" field exist in index that index connector link to but content is empty.

What can I do?

2

I think you are looking for Copy fields | Filebeat Reference [8.15] | Elastic processor

3

Thank you for reply.
I think the problem is not described correctly, I will describe it again

4

I couldn't find any good examples of this but I believe you'll need to do something like

{
    "failedreason": "{{#context.hits}}{{winlog.logon.failure.sub_status}}{{/context.hits}}"
}
5

You should try {{_source.winlog.logon.failure.sub_status}}

see: {{winlog.logon.failure.sub_status}}

1 Like
6

Unlucky, It doesn't work.
failedreason is empty

7

Unlucky, It doesn't work.
failedreason is empty.