# Couple items for ES

**URL:** <https://community.zeek.org/t/couple-items-for-es/4335>\
**Category:** Zeek\
**Created:** [September 13, 2016, 5:31pm UTC](https://community.zeek.org/t/couple-items-for-es/4335 "2016-09-13T17:31:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [September 13, 2016, 5:31pm UTC](https://community.zeek.org/t/couple-items-for-es/4335/1 "2016-09-13T17:31:55Z")

</div>

From the page:

[https://www.bro.org/sphinx/components/bro-plugins/elasticsearch/README.html](https://www.bro.org/sphinx/components/bro-plugins/elasticsearch/README.html)

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [September 14, 2016, 3:53pm UTC](https://community.zeek.org/t/couple-items-for-es/4335/2 "2016-09-14T15:53:26Z")

</div>

And a couple more (guess what I’m doing today…)

The below fixes dots in field names (id.orig\_h for example) with ES 2.4.0:

[https://www.elastic.co/guide/en/elasticsearch/reference/current/dots-in-names.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/dots-in-names.html)

a lot of your fields you can map via Kibana, but a couple you can’t, namely ts, id.orig\_h, id.resp\_h. Once that’s done here’s a curl line to create a mapping template:

curl -XPUT “[http://localhost:9200/\_template/bro\_template](http://localhost:9200/_template/bro_template)” -d’  
{  
“template”: “bro-\*”,  
“mappings”: {  
“bro\_ts”: {  
“properties”: {  
“ts”: {  
“type”: “date”,  
“format”: “epoch\_millis”  
}  
}  
},  
“bro\_orig\_h”: {  
“properties”: {  
“id.orig\_h”: {  
“type”: “ip”  
}  
}  
},  
“bro\_resp\_h”: {  
“properties”: {  
“id.resp\_h”: {  
“type”: “ip”  
}  
}  
}  
}  
}’

this will allow new indexes to have the above. For me as this is a new install I just nuked all bro-\* indexes and started over, THEN I went to Kibana to add bro-\* as an index where ts shows as the time-field name:

 ![](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/4547d502ddaca7044c72642343d497b68f007906.jpeg)

Hope this helps someone in the world 🙂

James

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [September 15, 2016, 2:35pm UTC](https://community.zeek.org/t/couple-items-for-es/4335/3 "2016-09-15T14:35:24Z")

</div>

In 2.5 (beta right now), you can do this...  
redef Log::default\_scope\_sep = "\_";

That will get rid of periods from your logs field names in all logs.

.Seth

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [September 15, 2016, 2:40pm UTC](https://community.zeek.org/t/couple-items-for-es/4335/4 "2016-09-15T14:40:48Z")

</div>

Excellent....file that under the "more than one way to skin a cat" category...looking forward to 2.5..thanks Seth.

James

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/couple-items-for-es/4335/5 "2022-05-06T15:44:00Z")

</div>