Pushing feeds from MISP to ELK using filebeat

[mav8140]

Hi Team,

I have set configuration as per image attached for misp.yml

also i have done few configuration in filebeat.yml

Please guide how can I see feeds in kibana? as Initially while I worked on this all system logs of ubuntu were seen in kibana. I need support for working on this scenario.

thanks.

Please consider the following notes

• Critical security bugs can be reported, preferably PGP encrypted, by mail to: info@circl.lu
• Bug reports and feature requests can be filed as an issue on github: https://github.com/MISP/MISP/issues
• For interactive support please join the Gitter chat on: https://gitter.im/MISP/MISP

The official documentation of MISP can be found here: https://www.circl.lu/doc/misp/
We also periodically do user/admin/developer trainings and have our training material online: https://www.circl.lu/services/misp-training-materials/

Nevertheless you can of course file a Support request as an issue. Please be as precise as possible and fill the template as detailed as possible too.
Please remove this text until the line below. Thanks a lot.
--------8<------

Work environment

Questions	Answers
Type of issue	Support
OS version (server)	Debian, Ubuntu, CentOS, RedHat, ...
OS version (client)	MacOS, Win10, Ubuntu, ...
PHP version	5.4, 5.5, 5.6, 7.0, 7.1... (if relevant)
MISP version / git hash	2.4.XX, hash of the commit
Browser	If applicable

Support Questions

Logs, screenshots, configuration dump, ...

[adulau]

Thank you for the issue but it's related to Elastic filebeat.

When googling, there is an issue in Elastic filebeat:

elastic/beats#25240 mentioning the following:

The existing MISP Filebeat module can begin a deprecation pipeline now that the capabilities have been folded into the new Threat Intel Filebeat module.

• Existing MISP Filebeat Module - https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-misp.html
• New MISP feature of the Threat Intel Filebeat Module - https://www.elastic.co/guide/en/beats/filebeat/7.12/filebeat-module-threatintel.html#_misp_fileset_settings https://www.elastic.co/guide/en/beats/filebeat/7.12/images/filebeat-threatintel-misp.png