I'm trying to set up receiving logs from domain controllers. But there is no kibanet No data streams, indices, or index aliases match your index pattern. curl -XGET 'http://localhost:9200/_search?size=10000&pretty'
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 0,
"successful" : 0,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 0,
"relation" : "eq"
},
"max_score" : 0.0,
"hits" : [ ]
}
}
Data is not coming in logstash /etc/logstash/conf.d filter.conf:
filter {
if "winsrvad" in [tags] {
if [winlog][event_id] != "5136" and [winlog][event_id] != "5139" and [winlog][event_id] != "5141" and [winlog][event_id] != "5137" and [winlog][event_id] != "4741" and [winlog][event_id] != "4742" and [winlog][event_id$
drop { }
}
}
}
input.conf:
input {
beats {
port => 5044
}
}
output.conf:
output {
if [type] == "winsrvad" {
elasticsearch {
host => "localhost:9200"
index => "winsrvas-%{+YYYY.MM.dd}"
user => Logstash
password => xxxxxxxxx
}
]
}
winlogbeat:
winlogbeat.event_logs:
- name: ForwardedEvents
forwarded: true
# ignore_older: 72h
tags: ["winsrvad"]
output.logstash:
hosts: ["192.169.1.30:5044"]
#logging.level: info
#logging.to_files: true
logging.files:
path: C:\ProgramData\winlogbeat\logs
# name: winlogbeat.log
# keepfiles: 3