[Filebeat] Replace Suricata/Eve fields with aliases to ECS fields

dev-tools/ecs-migration.yml

@@ -171,6 +171,121 @@
   alias: true
   beat: filebeat
 
+- from: suricata.eve.alert.action
+  to: event.outcome
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.alert.severity
+  to: event.severity
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.app_proto
+  to: network.protocol
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.dest_ip
+  to: destination.ip
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.dest_port
+  to: destination.port
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.event_type
+  to: event.type
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.fileinfo.filename
+  to: file.path
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.fileinfo.size
+  to: file.size
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.flow.start
+  to: event.start
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.flow.bytes_toclient
+  to: destination.bytes
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.flow.bytes_toserver
+  to: source.bytes
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.flow.pkts_toclient
+  to: destination.packets
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.flow.pkts_toserver
+  to: source.packets
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.http.hostname
+  to: url.domain
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.http.http_method
+  to: http.request.method
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.http.http_refer
+  to: http.request.referrer
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.http.http_user_agent
+  to: user_agent.original
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.http.length
+  to: http.response.body.bytes
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.http.status
+  to: http.response.status_code
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.proto
+  to: network.transport
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.src_ip
+  to: source.ip
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.src_port
+  to: source.port
+  alias: true
+  beat: filebeat
+
+- from: suricata.eve.timestamp
+  to: '@timestamp'
+  alias: true
+  beat: filebeat
+
 ## System module
 
 - from: system.syslog.hostname

filebeat/docs/fields.asciidoc

@@ -10706,7 +10706,9 @@ Fields exported by the EVE JSON logs
 *`suricata.eve.event_type`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: event.type
 
 --
 
@@ -10792,7 +10794,9 @@ type: keyword
 *`suricata.eve.fileinfo.filename`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: file.path
 
 --
 
@@ -10841,7 +10845,9 @@ type: keyword
 *`suricata.eve.fileinfo.size`*::
 +
 --
-type: long
+type: alias
+
+alias to: file.size
 
 --
 
@@ -10855,21 +10861,27 @@ type: long
 *`suricata.eve.dest_port`*::
 +
 --
-type: long
+type: alias
+
+alias to: destination.port
 
 --
 
 *`suricata.eve.src_port`*::
 +
 --
-type: long
+type: alias
+
+alias to: source.port
 
 --
 
 *`suricata.eve.proto`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: network.transport
 
 --
 
@@ -10883,7 +10895,9 @@ type: long
 *`suricata.eve.src_ip`*::
 +
 --
-type: ip
+type: alias
+
+alias to: source.ip
 
 --
 
@@ -10962,7 +10976,9 @@ type: keyword
 *`suricata.eve.dest_ip`*::
 +
 --
-type: ip
+type: alias
+
+alias to: destination.ip
 
 --
 
@@ -10977,7 +10993,9 @@ type: long
 *`suricata.eve.http.status`*::
 +
 --
-type: long
+type: alias
+
+alias to: http.response.status_code
 
 --
 
@@ -10991,7 +11009,9 @@ type: keyword
 *`suricata.eve.http.http_user_agent`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: user_agent.original
 
 --
 
@@ -11005,7 +11025,9 @@ type: keyword
 *`suricata.eve.http.http_refer`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: http.request.referrer
 
 --
 
@@ -11019,21 +11041,27 @@ type: keyword
 *`suricata.eve.http.hostname`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: url.domain
 
 --
 
 *`suricata.eve.http.length`*::
 +
 --
-type: long
+type: alias
+
+alias to: http.response.body.bytes
 
 --
 
 *`suricata.eve.http.http_method`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: http.request.method
 
 --
 
@@ -11047,7 +11075,9 @@ type: keyword
 *`suricata.eve.timestamp`*::
 +
 --
-type: date
+type: alias
+
+alias to: @timestamp
 
 --
 
@@ -11069,7 +11099,9 @@ type: keyword
 *`suricata.eve.alert.severity`*::
 +
 --
-type: long
+type: alias
+
+alias to: event.severity
 
 --
 
@@ -11097,7 +11129,9 @@ type: keyword
 *`suricata.eve.alert.action`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: event.outcome
 
 --
 
@@ -12045,21 +12079,27 @@ type: keyword
 *`suricata.eve.flow.bytes_toclient`*::
 +
 --
-type: long
+type: alias
+
+alias to: destination.bytes
 
 --
 
 *`suricata.eve.flow.start`*::
 +
 --
-type: date
+type: alias
+
+alias to: event.start
 
 --
 
 *`suricata.eve.flow.pkts_toclient`*::
 +
 --
-type: long
+type: alias
+
+alias to: destination.packets
 
 --
 
@@ -12080,7 +12120,9 @@ type: keyword
 *`suricata.eve.flow.bytes_toserver`*::
 +
 --
-type: long
+type: alias
+
+alias to: source.bytes
 
 --
 
@@ -12094,7 +12136,9 @@ type: keyword
 *`suricata.eve.flow.pkts_toserver`*::
 +
 --
-type: long
+type: alias
+
+alias to: source.packets
 
 --
 
@@ -12115,7 +12159,9 @@ type: boolean
 *`suricata.eve.app_proto`*::
 +
 --
-type: keyword
+type: alias
+
+alias to: network.protocol
 
 --
 

x-pack/filebeat/module/suricata/_meta/kibana/7/dashboard/Filebeat-Suricata-Alert-Overview.json

@@ -226,10 +226,10 @@
         "columns": [
           "host.name",
           "suricata.eve.flow_id",
-          "suricata.eve.src_ip",
-          "suricata.eve.src_port",
-          "suricata.eve.dest_ip",
-          "suricata.eve.dest_port",
+          "source.ip",
+          "source.port",
+          "destination.ip",
+          "destination.port",
           "source.geo.country_iso_code",
           "destination.geo.country_iso_code"
         ],