# Zeek filebeat - HTTP and TLS events not fully populating

**URL:** <https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830>\
**Category:** SIEM\
**Created:** [March 24, 2020, 12:28pm UTC](https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830 "2020-03-24T12:28:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lw24](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lw24](https://discuss.elastic.co/u/lw24)\
**Post date:** [March 24, 2020, 12:28pm UTC](https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830/1 "2020-03-24T12:28:13Z")

</div>

I have a Security Onion VM with Filebeats on it with Zeek module enabled. I've edited the zeek.yml file to point to /nsm/bro/logs/current and have all the events being pulled through to Kibana.

DNS events are fully populating with source and destination IP, however HTTP and TLS are not. HTTP events in kibana contain source and destination ports as well as the HTTP response, but don't contain IP.  
SSL events are the same, not populating with source and destination IP.

Any advice would be really appreciated!

---

<div class="post-metadata">

**Author:** ![lw24](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lw24](https://discuss.elastic.co/u/lw24)\
**Post date:** [March 31, 2020, 7:30pm UTC](https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830/2 "2020-03-31T19:30:08Z")

</div>

Can anyone help with this?

I've edited the Zeek filebeat config within Security Onion to pull the source and destination IP through, however in Kibana SIEM there are still no events populating under HTTP or TLS.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/5/6507cebf36705f05f73dc1081e9a46649dd4ed43.png)

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [April 4, 2020, 4:56pm UTC](https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830/3 "2020-04-04T16:56:22Z")

</div>

Hi @lw24, what version of the beats and Kibana are you running? Is it 7.6.2 right now?

We had this bug where TLS is not populating when using beats 7.6.2 and Kibana 7.6.2:

> <https://github.com/elastic/kibana/pull/60854>

Where the fix is projected to land in the upcoming 7.2.0

---

<div class="post-metadata">

**Author:** ![lw24](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@lw24](https://discuss.elastic.co/u/lw24)\
**Post date:** [April 11, 2020, 11:14am UTC](https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830/4 "2020-04-11T11:14:10Z")

</div>

Elasticsearch and Kibana are v7.6.1

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2020, 11:14am UTC](https://discuss.elastic.co/t/zeek-filebeat-http-and-tls-events-not-fully-populating/224830/5 "2020-05-09T11:14:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.