Sending PCAP events to ELK using Suricata

Hello All,

I am very new to Suricata, as I just went through troubleshooting integrating Suricata with ELK where logstash index wouldn’t show on ELK. Thankfully I was able to get the issue fixed.

My question is, how can I ingest pcap dataset (in my local machine) into ELK? I want pcap data to display on ELK so later I can use Yara rules for analysis.

Hi momo, welcome to our community! :slight_smile:

Maybe this post could help you? Ingesting PCAPS in SELKS Docker