Hello Long story short, we are using gGaylog to read from elastic indexes of course, but, i have a need to write my indexes in the Elastic Common Scheme (ECS) format that the native elastic tools such as “Beats” create, which they are not or do not appear to be now. Is there any way i can tell Gra…

I believe you are delving into how Graylog queries Elasticsearch… Graylog isn’t a front end for all of Elasticsearch’s (and by extension, beats) features and generally expects to only find what it has placed into Elasticsearch (beats, routed to Graylog via sidecar, then stored in Elasticsearch. …

I appreciate the response, yeah… ive been told this may be possible, but nothing about the how. The trick is that elastic agents write in a different format, and i dont have the knowledge to change it. If i could i would solve a ton of issues and be able to support my existing architecture how we …

I wonder if someone using Elastic Security can maybe post the mappings for the relevant indices? I don’t have a live one available to me currently. Im trying to build one but info from an actual working one would be helpful.

Pose this as a new question - other members of the forum won’t see your request as it is embedded in the thread of your original question… you might have better luck with in depth questions on Elastic Security on the Elasticsearch forums…

Graylog using ECS format index

Graylog Central (peer support)

tmacgbay (Tmacgbay) August 1, 2022, 7:30pm 4

A while back I wrote up some detail on custom mappings and changing existing indexes to match your desired field type… perhaps you can pull some detail out of there to help bend Graylog/ElasticSearch to your will?

Topic		Replies	Views
Existing Elasticsearch and Graylog Graylog Central (peer support)	4	3196	September 12, 2017
Use both Graylog and Elastic Stack Graylog Central (peer support)	10	4473	May 3, 2018
How to configure graylog to display logs from elasticsearch Graylog Central (peer support) filebeat-linux	6	7037	July 31, 2023
Elasticsearch input Graylog Central (peer support)	11	3074	December 15, 2018
Graylog indices Graylog Central (peer support)	22	6922	June 27, 2018

Graylog using ECS format index

Related topics