Fields in Kibana dashboard not in exported CSV

[Sakorah]

Hi,

I have parsedmarc up and running and get now the data in the CSV files and ingest these further into Elasticsearch. I tried to use the provided Kibana dashboards but the fields in the visualisations do not match the fields available in the CSV.

Some fields are missing like: message_count passed_dmarc date_range

Where do these values come from?

[Ejento]

Some fields are missing like: message_count passed_dmarc date_range

Did you manage to find a fix for that? I have the same issue at the moment.

[Sakorah]

unfortunately not, but I didn't had time to investigate this further.

[seanthegeek]

The Kibana dashboards are based on data sent to Elasticsearch directly by the parsedmarc script, not by ingesting the CSV, which uses different fields.

[Sakorah]

alright, I thought that the output to CSV/JSON has the same content as to Elasticsearch - but that's not the case is it? Is the output to Splunk the same as to ES? Cause I cannot directly connect any client to ES, I need to run all incoming events through Logstash.

[seanthegeek]

The JSON should be the same