Sync with ELK 7.x


Be sure you are running ELK (elasticsearch, filebeat and kibana) with version >7.3.2

As usual, please keep in contact if there is any clarification or help needed.

We will need to modify a bit the Wazuh’s default filebeat configuration, we will do:

  • import OwlH-Kibana objects in Kibana
  • load OwlH template in Elasticsearch
  • install OwlH-Filebeat module
  • modify Wazuh’s module to exclude OwlH Lines
  • modify Filebeat main configuration to include OwlH module


You must have access to your Wazuh’s manager shell console where Filebeat is installed and to Kibana’s console


Please, check URLs and paths to ensure you use the right commands and that you adapt command lines as needed.

Download files and prepare

# cd /tmp
# mkdir /tmp/owlhfilebeat
# wget
# tar -C /tmp/owlhfilebeat -xf owlh-filebeat-7.4-files.tar.gz

Import OwlH kibana dashboards and objects in Kibana

# curl -X POST "localhost:5601/api/saved_objects/_import" -H "kbn-xsrf: true" --form file=@/tmp/owlhfilebeat/owlh-kibana-objects-20191030.ndjson

Install OwlH template

# curl -XPUT -H 'Content-Type: application/json' 'http://localhost:9200/_template/owlh' -d@/tmp/owlhfilebeat/owlh-template.json

Install OwlH module

# tar -C /usr/share/filebeat/module/ -xf /tmp/owlhfilebeat/owlh-filebeat-7.4-module.tar.gz

Modify Wazuh Module

# vi /usr/share/filebeat/module/wazuh/alerts/config/alerts.yml


be sure your file looks like this

  index_prefix: {{ .index_prefix }}
type: log
{{ range $i, $path := .paths }}
 - {{$path}}
{{ end }}
exclude_lines: ["bro_engine"]

Modify filebeat

Modify Filebeat configuration

# vi /etc/filebeat/filebeat.yml


be sure your file looks like this

# Wazuh - Filebeat configuration file
  - module: wazuh
      enabled: true
      enabled: false
# OwlH Module
  - module: owlh
      enabled: true

setup.template.json.enabled: true
setup.template.json.path: '/etc/filebeat/wazuh-template.json' 'wazuh'
setup.template.overwrite: true
setup.ilm.enabled: false
## OwlH pipeline sync
filebeat.overwrite_pipelines: true

Restart Filebeat

You should be done. check your kibana to see the OwlH dashboards in dashboards section, and indices in discovery section.

Restart Filebeat

# systemctl restart filebeat

Check Filebeat output

# journalctl -f -u filebeat

From your web browser, check kibana->dashboards