Title
#general
killahquam

killahquam

08/10/2018, 9:03 PM
hi all, anyone using osquery module in filebeat with ELK. all my fields in kibana starts with json. i.e json.host_identifier despite having var.namespace: true
defensivedepth

defensivedepth

08/11/2018, 1:35 PM
var.use_namespace should be true by default. I have not set it, and I am seeing expected results (ie osquery.result)
killahquam

killahquam

08/13/2018, 7:48 AM
@defensivedepth not for me, a lot of items are starting as json.host_Identifier, etc
defensivedepth

defensivedepth

08/13/2018, 11:34 AM
What does your osquery module config look like? Also what version are you running?
killahquam

killahquam

08/13/2018, 4:51 PM
@defensivedepth filbeat version 6.3.2
4:51 PM
filebeat.modules:- module: osquery result: enabled: true var.paths: [“/tmp/osquery_result”] var.use_namespace: true
defensivedepth

defensivedepth

08/13/2018, 4:58 PM
hmmm. Are you doing any processing in Filebeat before outputting? Also, what does your FB output look like?
killahquam

killahquam

08/13/2018, 5:12 PM
i dont think so, the FB output from /logs u mean ?
5:12 PM
that looks normal
defensivedepth

defensivedepth

08/13/2018, 5:21 PM
Under your FB Outputs, are you sending directly to ES?
killahquam

killahquam

08/13/2018, 5:23 PM
logstash
5:24 PM
should it be to ES instead?
defensivedepth

defensivedepth

08/13/2018, 5:29 PM
Well, that is probably the issue. iirc, the osquery module uses the ES ingest node, so that is probably where some of that of that normalization is happening.
killahquam

killahquam

08/13/2018, 5:30 PM
so, send the data from filebeat to ES and then ES will deal with the rest ?
5:30 PM
let me try
defensivedepth

defensivedepth

08/13/2018, 7:01 PM
Yes, try that
killahquam

killahquam

08/13/2018, 8:00 PM
nope gave me an error
8:00 PM
that connection refused but i know 9200 is open and listening
8:00 PM
its from one box to another
defensivedepth

defensivedepth

08/13/2018, 8:20 PM
Can you do a successful ‘curl ElasticHost:9200’ from the FB system?
killahquam

killahquam

08/13/2018, 8:27 PM
nope connection refused
8:27 PM
but on the elk box same this does output
8:28 PM
so i think it just not listening outside of itself
defensivedepth

defensivedepth

08/13/2018, 8:31 PM
Check the ES config file (elasticsearch.yml) for the network.host setting. https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html
killahquam

killahquam

08/13/2018, 8:31 PM
yup that was it
8:31 PM
it wasn’t set to accept outside of 127.0.0.1
8:31 PM
am getting a kibana error but let me check
defensivedepth

defensivedepth

08/13/2018, 8:32 PM
not sure of your setup, but make sure that it isnt publicly accessible now 🙂
killahquam

killahquam

08/13/2018, 8:32 PM
yeah
8:39 PM
it now works
8:39 PM
thanks the issue was i wasn’t sending to elasticsearch and directly to logstash @defensivedepth thank you