- Filebeat Reference: other versions:
- Filebeat overview
- Quick start: installation and configuration
- Set up and run
- Upgrade
- How Filebeat works
- Configure
- Inputs
- Multiline messages
- AWS CloudWatch
- AWS S3
- Azure Event Hub
- Azure Blob Storage
- Benchmark
- CEL
- Cloud Foundry
- CometD
- Container
- Entity Analytics
- ETW
- filestream
- GCP Pub/Sub
- Google Cloud Storage
- HTTP Endpoint
- HTTP JSON
- journald
- Kafka
- Log
- MQTT
- NetFlow
- Office 365 Management Activity API
- Redis
- Salesforce
- Stdin
- Streaming
- Syslog
- TCP
- UDP
- Unified Logs
- Unix
- winlog
- Modules
- General settings
- Project paths
- Config file loading
- Output
- Kerberos
- SSL
- Index lifecycle management (ILM)
- Elasticsearch index template
- Kibana endpoint
- Kibana dashboards
- Processors
- Define processors
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- append
- cache
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_cef
- decode_csv_fields
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- parse_aws_vpc_flow_log
- rate_limit
- registered_domain
- rename
- replace
- script
- syslog
- timestamp
- translate_ldap_attribute
- translate_sid
- truncate_fields
- urldecode
- Autodiscover
- Internal queue
- Logging
- HTTP endpoint
- Regular expression support
- Instrumentation
- Feature flags
- filebeat.reference.yml
- Inputs
- How to guides
- Override configuration settings
- Load the Elasticsearch index template
- Change the index name
- Load Kibana dashboards
- Load ingest pipelines
- Enrich events with geoIP information
- Deduplicate data
- Parse data using an ingest pipeline
- Use environment variables in the configuration
- Avoid YAML formatting problems
- Migrate
log
input configurations tofilestream
- Migrating from a Deprecated Filebeat Module
- Modules
- Modules overview
- ActiveMQ module
- Apache module
- Auditd module
- AWS module
- AWS Fargate module
- Azure module
- CEF module
- Check Point module
- Cisco module
- CoreDNS module
- CrowdStrike module
- Cyberark PAS module
- Elasticsearch module
- Envoyproxy Module
- Fortinet module
- Google Cloud module
- Google Workspace module
- HAproxy module
- IBM MQ module
- Icinga module
- IIS module
- Iptables module
- Juniper module
- Kafka module
- Kibana module
- Logstash module
- Microsoft module
- MISP module
- MongoDB module
- MSSQL module
- MySQL module
- MySQL Enterprise module
- NATS module
- NetFlow module
- Nginx module
- Office 365 module
- Okta module
- Oracle module
- Osquery module
- Palo Alto Networks module
- pensando module
- PostgreSQL module
- RabbitMQ module
- Redis module
- Salesforce module
- Santa module
- Snyk module
- Sophos module
- Suricata module
- System module
- Threat Intel module
- Traefik module
- Zeek (Bro) Module
- ZooKeeper module
- Zoom module
- Exported fields
- ActiveMQ fields
- Apache fields
- Auditd fields
- AWS fields
- AWS CloudWatch fields
- AWS Fargate fields
- Azure fields
- Beat fields
- Decode CEF processor fields fields
- CEF fields
- Checkpoint fields
- Cisco fields
- Cloud provider metadata fields
- Coredns fields
- Crowdstrike fields
- CyberArk PAS fields
- Docker fields
- ECS fields
- Elasticsearch fields
- Envoyproxy fields
- Fortinet fields
- Google Cloud Platform (GCP) fields
- google_workspace fields
- HAProxy fields
- Host fields
- ibmmq fields
- Icinga fields
- IIS fields
- iptables fields
- Jolokia Discovery autodiscover provider fields
- Juniper JUNOS fields
- Kafka fields
- kibana fields
- Kubernetes fields
- Log file content fields
- logstash fields
- Lumberjack fields
- Microsoft fields
- MISP fields
- mongodb fields
- mssql fields
- MySQL fields
- MySQL Enterprise fields
- NATS fields
- NetFlow fields
- Nginx fields
- Office 365 fields
- Okta fields
- Oracle fields
- Osquery fields
- panw fields
- Pensando fields
- PostgreSQL fields
- Process fields
- RabbitMQ fields
- Redis fields
- s3 fields
- Salesforce fields
- Google Santa fields
- Snyk fields
- sophos fields
- Suricata fields
- System fields
- threatintel fields
- Traefik fields
- Windows ETW fields
- Zeek fields
- ZooKeeper fields
- Zoom fields
- Monitor
- Secure
- Troubleshoot
- Get help
- Debug
- Understand logged metrics
- Common problems
- Error extracting container id while using Kubernetes metadata
- Can’t read log files from network volumes
- Filebeat isn’t collecting lines from a file
- Too many open file handlers
- Registry file is too large
- Inode reuse causes Filebeat to skip lines
- Log rotation results in lost or duplicate events
- Open file handlers cause issues with Windows file rotation
- Filebeat is using too much CPU
- Dashboard in Kibana is breaking up data fields incorrectly
- Fields are not indexed or usable in Kibana visualizations
- Filebeat isn’t shipping the last line of a file
- Filebeat keeps open file handlers of deleted files for a long time
- Filebeat uses too much bandwidth
- Error loading config file
- Found unexpected or unknown characters
- Logstash connection doesn’t work
- Publishing to Logstash fails with "connection reset by peer" message
- @metadata is missing in Logstash
- Not sure whether to use Logstash or Beats
- SSL client fails to connect to Logstash
- Monitoring UI shows fewer Beats than expected
- Dashboard could not locate the index-pattern
- High RSS memory usage due to MADV settings
- Contribute to Beats
This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
Zeek (Bro) Module
editZeek (Bro) Module
editThis is a module for Zeek, which used to be called Bro. It parses logs that are in the Zeek JSON format.
The Zeek SSL fileset will handle fields from these scripts if they are installed in Zeek.
Read the quick start to learn how to configure and run modules.
Compatibility
editThis module has been developed against Zeek 2.6.1, but is expected to work with newer versions of Zeek.
Zeek requires a Unix-like platform, and it currently supports Linux, FreeBSD, and Mac OS X.
capture_loss
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
connection
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
dce_rpc
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
dhcp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
dnp3
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
dns
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
dpd
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
files
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
ftp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
files
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
http
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
intel
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
irc
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
kerberos
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
modbus
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
mysql
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
notice
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
ntls
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
ntp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
ocsp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
pe
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
radius
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
rdp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
rfb
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
signature
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
sip
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
smb_cmd
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
smb_files
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
smb_mapping
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
smtp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
snmp
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
socks
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
ssh
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
ssl
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
stats
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
syslog
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
traceroute
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
tunnel
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
weird
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
. -
var.internal_networks
-
A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
network.direction
. The values can be either a CIDR value or one of the named ranges supported by thenetwork
condition. The default value is[private]
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.
x509
log fileset settings
edit-
var.paths
-
An array of glob-based paths that specify where to look for the log files. All
patterns supported by Go Glob
are also supported here. For example, you can use wildcards to fetch all files
from a predefined level of subdirectories:
/path/to/log/*/*.log
. This fetches all.log
files from the subfolders of/path/to/log
. It does not fetch log files from the/path/to/log
folder itself. If this setting is left empty, Filebeat will choose log paths based on your operating system. -
var.tags
-
A list of tags to include in events. Including
forwarded
indicates that the events did not originate on this host and causeshost.name
to not be added to events. Defaults to[suricata]
.
Example dashboard
editThis module comes with a sample dashboard. For example:

Fields
editFor a description of each field in the module, see the exported fields section.
On this page
- Compatibility
capture_loss
log fileset settingsconnection
log fileset settingsdce_rpc
log fileset settingsdhcp
log fileset settingsdnp3
log fileset settingsdns
log fileset settingsdpd
log fileset settingsfiles
log fileset settingsftp
log fileset settingsfiles
log fileset settingshttp
log fileset settingsintel
log fileset settingsirc
log fileset settingskerberos
log fileset settingsmodbus
log fileset settingsmysql
log fileset settingsnotice
log fileset settingsntls
log fileset settingsntp
log fileset settingsocsp
log fileset settingspe
log fileset settingsradius
log fileset settingsrdp
log fileset settingsrfb
log fileset settingssignature
log fileset settingssip
log fileset settingssmb_cmd
log fileset settingssmb_files
log fileset settingssmb_mapping
log fileset settingssmtp
log fileset settingssnmp
log fileset settingssocks
log fileset settingsssh
log fileset settingsssl
log fileset settingsstats
log fileset settingssyslog
log fileset settingstraceroute
log fileset settingstunnel
log fileset settingsweird
log fileset settingsx509
log fileset settings- Example dashboard
- Fields
Was this helpful?
Thank you for your feedback.