Do I need to create index pattern (data view) on Kibana ?

[mahmoudelhaj]

Do I need to create index pattern (data view) on Kibana on Security Onion
Ex:
index --> firewall-*
index --> winlogbeat-*
index --> filebeat-*
index --> wazuh-*

instead of default index so-*

[cm-ops]

Can you expand on your question? There are ingest node pipelines that will put those logs into an so- index, for example so-beats, so-ossec, so-$filebeatmodulename (like so-cisco, so-fortinet, etc.).

[mahmoudelhaj]

My question: I need to search all indexes for Wazuh logs "so-ossec", how to do it? without use the default index so-*

[cm-ops]

In SOC there is a dashboard for Wazuh logs, in Kibana it is Security Onion - Wazuh to see the data. If you are using Kibana Discover use event.module:ossec AND event.dataset:"alert" to search.