molu8bits / snort-siem-grafana Goto Github PK

Hi everyone I have Grafana v 7.5.7 and I 'm trying to extract some content from my data.

In this case, my goal is to take the message from snort alert.
I created event.original as my own variable to collect data from elasticsearch and now I can see my logs.

These values are store by a variable called snort.

However I need extract only the message of the alert, in the section Query

Ex: What I have:

05/27-11:30:12.466603 [] [1:19559:13] “INDICATOR-SCAN SSH brute force login attempt” [] [Classification: Misc activity] [Priority: 3] {TCP} x.x.x.x:53962 → x.x.x.x:xx

What I need:

INDICATOR-SCAN SSH brute force login attempt

If anyone knows how I can do, please help me, I didn't get any answer from Grafana's community.

Details:

Grafana 7.5.7
Elastic 7.11
Linux OS
I would like to know how can I get unique values from elasticsearch with Grafana’s query editor.

I have the next picture:

It shows SSH Detected several times and I wish it just once.

I don't know how to do this, I need some help.

Thanks!