Rocky 9 VM. Zeek version 6.0.4
Running into an issue where filebeat isn't processing zeek logs after enabling zeek module. I can get filebeat to process the logs manually through filebeat.yml
I verify through journalctl that filebeat is configuring the intended path of /var/zeek/logs/current/conn.log
Here's my zeek.yml
# Module: zeek
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-module-zeek.html
- module: zeek
connection:
enabled: true
var.paths: ["/var/zeek/logs/current/conn.log"]
Would love any guidance or help.