Missing index ecs-suricata-network-<date> [ solved ]

Suricata / Snort
#1

It is probably me but there is no new ecs-suricata- created today

I do not see how i coud block this from happening

configuration was validated for logstash, elastic, suricata and all were restarted

manually creating the index does not resolve anything, there are however many entries in rocknsm_server.log where typically there is just one for an index

the newly created ecs-suricata-network-2021.02.23 is now at 208b size

#2

due to manually creating the index and rebooting the machine appears to have solved the issue for now, now i’m anxious the index will not be there tomorrow either

update the index was correctly created today, the mishap was due to the fast.log and eve.log files were renamed to fast.log-00001 and eve.log-00001 respectively