When browsing the Kibana Discover tab I noticed that suricata.eve.timestamp and suricata.eve.flow.start were present for events that were NOT from Suricata. It's somewhat misleading to have the suricata.* fields rendered when it's not a suricata event.

These fields are not in the _source. They are aliases pointing to @timestamp and event.start, respectively, which did happen to exist in the events that I was browsing.

• beats/x-pack/filebeat/module/suricata/eve/_meta/fields.yml

  Lines 180 to 182 in e4686d0

  	- name: timestamp
  	type: alias
  	path: '@timestamp'

• beats/x-pack/filebeat/module/suricata/eve/_meta/fields.yml

  Lines 679 to 681 in e4686d0

  	- name: start
  	type: alias
  	path: event.start

History

These aliases were added (#10377) in order to avoid duplicating data storage in an event while still maintaining the original suricata EVE JSON structure.

Possible Solutions

• Remove the aliases and duplicate the data within _source.
• Remove the aliases and remove the suricata.* fields that renamed to an ECS field. Users familiar with the original EVE format might be a little lost until they learn ECS.
• Ideas?

Version: Filebeat 7.0.0 / Kibana 6.6.0