Hi. I am using the ELK with filebeat sending logs to elastic via suricata module. I have all configured but after some time the information on “discover” and “dashboard” just disappears. On the elastic and filebeat logs no error seems to appear. But if i do “systemctl status filebeat”, the following error shows up. ’ (status=400): {“type”:“mapper_parsing_exception”,“reason”:“failed to parse”,“caused_by”:{“type”:“illegal_argument_exception”,“reason”:“Cannot write to a field alias [suricata.eve.flow.start].”}}
This looks like an error after Filebeat has converted the Suricata event into its ECS format, so I hope your post over at Elastic forums can get an answer.
Is there anything else logged? Probably wishful thinking to get the full body of the message that its failing to parse.
Strange thing is that i followed the instructions step by step and i still get the error. I have all the latest versions of the packages as well. I can´t figure it out. Yesterday it was doing ok.