Missing category in 2.4

[OzzyKampha]

I have spun up an 2.4 import node and i saw that some of the fields are missing in the dashboard.
Is this because i used a import node or is it a bug in 2.4

[defensivedepth]

Thanks for testing out 2.4 and posting feedback - we really appreciate it!

This is not a bug - those logs just don't have the event.category field. That being said, we are looking at ways to improve the experience here so that it is more clear what is happening.

[rsneeden]

So how do we correct this behavior/data? I'm running beta 2 in my lab with the same "*Missing" event.category and 2.3.220 with a similar problem (syslog and kibana datasets). I've experienced this will several versions of 2.3 but have never found a corrective answer.

[dougburks]

@rsneeden Please see the reply above:

This is not a bug - those logs just don't have the event.category field. That being said, we are looking at ways to improve the experience here so that it is more clear what is happening.

[kawaiipantsu]

I would like te reopen this, as it's kinda important in the sense that you use this information to hunt/get an overview etc.
I fully understand that "It's by design" that it's writing *Missing but perhaps No Category would be more saying ...

That said, how to we etc add Categories to these streams ?
Is there a procedure to do it ? Perhaps even via the UI ?

In my screenshot i would say a lot of stuff like "Apache" should then just default point to something like "Middleware"
But i dont Understand "System" and "Security" does not have a category like "Host" or something ...

[defensivedepth]

I have created an issue to track adding category to the logs that ship with Elastic Agent. #11375

That category field should be set by the Elastic Integration. If it isn't, then we can set it manually via an Ingest Pipeline.

Are you using the Apache Elastic Integration?

[kawaiipantsu]

Yes, the above is multiple Elastic Agent with an profile that contains the "Apache integration" and the "Redis integration".

I'm trying to keep it as "clean" as possible, by that mean as close to how SO2 is shipped with minor local changes. As i tend to "re-implement" it often in my different forensic labs and "quick" tap setups.

[defensivedepth]

I would suggest creating an issue in the Elastic Integrations repo for the Apache & Redis integrations - to ask them to add event.category to those integrations. It is a core ECS field, so all integrations should include it.