Config Elastic Packetbeat graylog

[shoothub]

Please don’t install beast plugin for graylog, it is deprecated.
Normal Input - Beast would be enough.
Check also this blog post:

Tapping Wires for Lean Security Monitoring: DNS Request Analysis with Open...

And this:

Packebeat Input

Hi Jan, thanks for your support. Actually I solved the problem. I’m writing the solution right here in the hope somebody would find it useful. I found that the only way to have Packetbeat working with Graylog is to let it be run by Sidecar. So I needed to configure a new log collector manually (I found only winlogbeat, filebeat and nxlog template, despite on what I read on the website announcing version 3) and pushing this configuration: # Needed for Graylog fields_under_root: true fields.col…