opc40772 / suricata-graylog Goto Github PK

Howdy! So after the success if the pfSense dashboard that you provided, I figured I would try the Suricata one, especially after what I learned from the pfSense one.

The issue is, I can't get past the content pack piece... I am able to upload it, but I can't apply it. When I try to apply it, I get an error telling me to check the logs. This is an export of the log:

2018-09-27T23:32:09.037-04:00 INFO  [InputStateListener] Input [Beats/5a9b0dd0687cf800d1ef207c] is now STARTING
2018-09-27T23:32:09.040-04:00 ERROR [BundleImporter] Error while creating entities in content pack. Starting rollback.
com.mongodb.DuplicateKeyException: Write failed with error code 11000 and error message 'E11000 duplicate key error collection: graylog.lut_caches index: name_1 dup key: { : "cache-service-port" }'

I want to send only alerts from eve.json to Graylog, and not the entire eve.json. How to filter the output from filebeat? any ideas?