Section 200 (PROTECT) Beats

Francisco Duran
2024-09-06T11:23:14Z

I am getting all the Suricata alerts to show in Opnsense but I cannot see any alerts in Elastic. Filebeat output and config check OK and filebeat setup loaded ingest pipelines fine. Checking the error messages datafield in Elastic shows "Provided Grox expressions do not match field value, request suricata rule metadata. I have been troubleshooting this for a week and cannot get it to work.