Closed mxb78 closed 3 years ago
Current template for ES 7.x is not accepted by ES 7.10.2. "settings" , "mapping" etc need to be wrapped in side "template": {}. I managed to upload modified template, however no luck with getting any data in Evebox.
as of ES 7.8 current template falls under legacy and I get deprecation warning. No data in Evebox yet visible.
How do you add your events to Elasticsearch?
On Thu, Jan 21, 2021 at 2:48 PM mxb78 notifications@github.com wrote:
as of ES 7.8 current template falls under legacy and I get deprecation warning. No data in Evebox yet visible.
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/jasonish/evebox/issues/152#issuecomment-764927353, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAE5IE6RWISDDGCGHFKILSLS3CHIFANCNFSM4WLGJYZQ .
[root@ntop ~]# cat /etc/logstash/conf.d/30-output.conf output { elasticsearch { hosts => ["http://10.78.100.40"] index => "logstash-%{+YYYY.MM.dd}"
#password => "changeme"
} }
As mentioned, all been working well with ES 6.8.x
I managed to add current template as a legacy one. However evebox does not gives any output or any other indications/errors. I run "PUT /_template/logstash {}" from Kibana dev-tools. I guess templates name "logstash" is proper one (if I understood the code correctly)
Evebox should only add the template itself if it's also adding the events. Otherwise it won't install it, it lets Logstash do that.
Sometimes it helps to delete the current index and restart everything. Logstash will then recreate. Or you could reindex your current indices.
Has a whole day occurred where the index name would have rolled over?
I have several indexes for a 3 days. Before I installed ES 7.10.2,I removed all data on all 3 nodes I have.
I'll try to clean this out once more. Thanks for helping.
Does the events tab work?
If I recall correctly, the latest Evebox never installs a template anymore as it's not really needed, at least not if Logstash is being used.
Evebox version?
Inbox/Escalated/Alerts are empty. However, for whatever reason, I can see old reports and events. eg from the ES 6.x time. Browser cache? Evebox version is latest (is what you put into dockerhub - This is EveBox version 0.12.0 (rev: ba9d586); x86_64-unknown-linux-musl)
Restarting and cleaning some data helped out. Sorry for the noise and thank you. Case closed.
I'm having problems to see any events/alert or any other data since I upgraded ES from 6.x to 7.10.2. Logstash index is there. Looks like template for es7 does not get installed? Running evebox as a docker image with '-vvv' for extra DEBUG and see no output from log::info!("Installing template {}", &template). Any ideas?