Zeek & ELK integration (A lot of strange fields)

[test_qweqwe]

Hi there,
I set up ELK and then beats on Zeek server to send data to Elasticsearch.
Everything is good except one: there are a lot of fields - 308

And it creates an element of inconvenience for me to create a search. I think I've done something wrong, set it up wrong somewhere. There are even fields with the prefix "suricata".

How did you send Zeek logs to the ELK? What is your configuration?
What inputs do you need from me?

[Iker (Iker Saint)]

Hi, I think the problem is in the pipeline, maybe is missing from elastic, so the fields are not renamed, transformed, etc; this tutorial let you check all the steps for collecting the logs:

Collecting and analyzing Zeek data with Elastic Security

[test_qweqwe]

I did everything like in this guide.
But It didn't help.

[legoguy1000 (Alex)]

I believe all the suricata fields are showing because they're aliases of the ECS fields. I believe this has been fixed for future versions.

[test_qweqwe]

It's okay that there are a lot of fields?