Closed ngms17 closed 3 years ago
How are you adding your events to Elasticsearch?
Filebeat -> Logstash -> Elastic
But my index is not the logstash default
You will have to tell EveBox the name of your index prefix. So by default it assumes "logstash-*", the --index
can change that. However, EveBox only works against the default Logstash schema, so if you remap fields, or change the types, etc. Its unlikely to work.
It also doesn't work against ECS if using the Filebeat Suricata module. I'm working on that though.
I think that has been resolved. If an ECS issue, follow here: https://github.com/jasonish/evebox/issues/97
I am having this error while starting evebox server.