Sysmon for Linux Integration not sending to data_stream.dataset: "sysmon_linux.log"

vector_vulture
Sun, 13 Jul 2025 13:46:53 +0000
Elastic Agent

Hi. I am new to ELK stack, and I cannot find this problem online, so I am posting here. I have a self hosted ELK stack the newest version with the agents version 9.0.3. I also have 1 agent deployed as a fleet server via fleet server policy on the same machine running the ELK stack. All machines are Ubuntu 24.04 machines and 3 of them have agent's that are enrolled via a different Linux policy. Effectively, all machines have at least these integrations via the Elastic Agent:

System Integration
Auditd Logs Integration
Sysmon for Linux Integration

I can confirm Sysmon for linux is putting it's events in /var/log/syslog on the local machine. I can also confirm the data from /var/log/syslog is entering the ELK stack, because I can see those types of event's with that sysmon structure in the "message" field in Kibana Discover from my hosts if I filter for sysmon.

The problem is it coming into the SIEM as data_stream.dataset: "system.syslog" where I think it expects it to come in as data_stream.dataset: "sysmon_linux.log" which is what the Sysmon for Linux Logs Overview dashboard is looking at, and I think that distinction makes sense to have since the event have such a different structure.

Did I do something wrong with the integration or is this intended behaviour? If it's not normal how can I fix it? I did not make any changes to local agent files, only used fleet server to enroll via policy. All machines are synced via time server, have correct localization and timezone, have auditd and sysmon installed. Auditd with recommended rules and config, sysmon with a barebones xml config for linux/ubuntu machines, which is I think 7 event categories in total. All Agents also showing with healthy status and inputs.

According to the integration it should work I think so I am not sure what I did wrong. Any help would be appreciated.

7 posts - 2 participants