topic Re: Auditbeat add-one does not sourcetype log in Getting Data In

Auditbeat add-one does not sourcetype log

sigma — Mon, 24 Jun 2024 08:27:34 GMT

Hi all,

I recently installed this add-one on my cluster (hfs, idxs, shs). I copied props.conf and transforms.conf into local directory and uncomment the mappings to sourcetype elastic:auditbeat:log. But this action had no effect and yet I just see one sourcetype: elastic:auditbeat:log

any ideas are appreciated.
Thanks.

Re: Auditbeat add-one does not sourcetype log

richgalloway — Mon, 24 Jun 2024 11:44:21 GMT

What exactly did you change and what were the expected results?

The comments in transforms.conf and props.conf must not be un-commented because they are not valid settings.

Re: Auditbeat add-one does not sourcetype log

sigma — Tue, 25 Jun 2024 10:35:58 GMT

Thank you. Yes I was wrong about transforms.conf

actually I wan to generate sourcetype from elastic:auditbeat:log based on events as This link has specified.