WEF Forwarded Sysmon Logs don't populate some dashboard widgets

Cyb3rWard0g / HELK

The Hunting ELK

GNU General Public License v3.0

3.73k stars 675 forks source link

WEF Forwarded Sysmon Logs don't populate some dashboard widgets #502

Closed gluteusmax closed 3 years ago

gluteusmax commented 3 years ago

Describe the problem

I am using WEF to get logs to HELK ... the dashboards don't populate some of the charts, specifically those that reference a ".keyword field". (e.g. Could not locate that index-pattern-field (id: process_parent_name.keyword)

Is HELK supposed to accommodate forwarded event logs in the various pipelines and have the Dahsboards populate ?

Thanks,

gluteusmax commented 3 years ago

Apologies .. it seems I had enabled the processor for Forwarded events that Winlogbeat ships with and this was munging up the output. No issue here ...