# How to using existing ELK 7.2 stack as data source with 'siren investigate'? **URL:** \ **Category:** Siren Federate (Elasticsearch Plugin)\ **Created:** [September 5, 2019, 5:52pm UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127 "2019-09-05T17:52:42Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![asad\_ali](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/asad_ali/32/80_2.png) [@asad\_ali](https://community.siren.io/u/asad_ali)\ **Post date:** [September 5, 2019, 5:52pm UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/1 "2019-09-05T17:52:42Z")
Hi, My company is using ELK for over 1 year, mostly for security (SIEM) use-cases, but have always struggled to turn into a siem which provides advanced correlation rules, and alerting capabilities. We can do some using grok and in-line with logstash but on UI we struggle as it essentially is log-/data management UX. I stumble across SIREN , by chance and is so impressed by what the team has been achieving and solve really challenging problem regard to such enriched data alerting/ correlation capabilities. What I’m confused is with the architecture, I have indexes made of 2 dozen data sources e.g firewalls, routers , endpoints , AD etc. I want SIREN “investigate” to use existing data sources, prepare data-model, link graph based upon existing ELK setup which is version 7.2. I see with ‘federated plugin’ I can do this, and get me to cross-related fields across data-sources or indicies i.e join. But when I read about ‘siren investigation’ its installation / config is based upon elasticsearch 6.8 and maintaning its versioning of elasticsearch. So, with the plugin already using existing ELK , for "siren investigate’ and other components why I need different elasticsearch, my goal is use data-source which is already pre-populated using beats/ logstash and other stack tool to populate the indicies and use power of ‘siren’ to make data-model, investigation and alerts around it. I tried reading the docs(online), but couldn’t seem to get my head around it. Help is greatly appreciated. Thanks. ---
**Author:** ![renaud.delbru](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/renaud.delbru/32/13_2.png) [@renaud.delbru](https://community.siren.io/u/renaud.delbru)\ **Post date:** [September 6, 2019, 7:27am UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/2 "2019-09-06T07:27:42Z")
Hi, Siren Investigate relies on Siren Federate to perform data exploration and investigation operations. You cannot use Siren Investigate without Siren Federate. The latest version of Elasticsearch that Siren Federate supports is 6.8.x. Therefore the latest version of Elasticsearch that Investigate support is 6.8.x. We are planning to have support for Elasticsearch 7.x by the end of September or early October. Would this answer your question ? Kind Regards ---
**Author:** ![Lorenz](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/lorenz/32/98_2.png) [@Lorenz](https://community.siren.io/u/Lorenz)\ **Post date:** [November 19, 2019, 10:25am UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/3 "2019-11-19T10:25:48Z")
Hi Renaud. Any news regarding the 7.x support. Or did you meant September or early October 2020? 😉 Thanks ---
**Author:** ![renaud.delbru](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/renaud.delbru/32/13_2.png) [@renaud.delbru](https://community.siren.io/u/renaud.delbru)\ **Post date:** [November 19, 2019, 10:44am UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/4 "2019-11-19T10:44:29Z")
Hi Lorenz, Apologies for the delay, but we’re getting close. We have a 7.x version ready, and we are currently going through the last stages of the process (QA, documentation review, etc.). We are sincerely hoping to provide a Release Candidate next week. Kind Regards ---
**Author:** ![Lorenz](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/lorenz/32/98_2.png) [@Lorenz](https://community.siren.io/u/Lorenz)\ **Post date:** [November 19, 2019, 12:04pm UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/5 "2019-11-19T12:04:10Z")
Great! By any chances: Can you provide me a beta version? So we can go on with our implementation? Thanks Renaud. ---
**Author:** ![Lorenz](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/lorenz/32/98_2.png) [@Lorenz](https://community.siren.io/u/Lorenz)\ **Post date:** [November 27, 2019, 10:57am UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/6 "2019-11-27T10:57:33Z")
Hi Renaud, any news regarding the Release Candidate? Thanks in advanced, Lorenz ---
**Author:** ![Lorenz](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/lorenz/32/98_2.png) [@Lorenz](https://community.siren.io/u/Lorenz)\ **Post date:** [November 28, 2019, 2:20pm UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/7 "2019-11-28T14:20:10Z")
Renaud? Still alive? ---
**Author:** ![ekeller](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/ekeller/32/40_2.png) [@ekeller](https://community.siren.io/u/ekeller)\ **Post date:** [November 28, 2019, 4:32pm UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/8 "2019-11-28T16:32:00Z")
Hi Lorenz, The team is absolutely alive ! We are working hard to deliver the first release for ES 7. It is a matter of (few) days now… Sorry for the delay, I will keep you updated. ---
**Author:** ![Lorenz](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/lorenz/32/98_2.png) [@Lorenz](https://community.siren.io/u/Lorenz)\ **Post date:** [December 2, 2019, 4:41pm UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/9 "2019-12-02T16:41:01Z")
OK, good to know - I cross my fingers, hoping on a release before chritmas 🙂 ---
**Author:** ![Lorenz](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/lorenz/32/98_2.png) [@Lorenz](https://community.siren.io/u/Lorenz)\ **Post date:** [December 18, 2019, 10:42am UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/10 "2019-12-18T10:42:02Z")
Ohhhh… X-Max is comming… Still not released? ---
**Author:** ![mike.hughes](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/mike.hughes/32/10_2.png) [@mike.hughes](https://community.siren.io/u/mike.hughes)\ **Post date:** [December 20, 2019, 12:37pm UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/11 "2019-12-20T12:37:48Z")
Federate 7.3.2-19.0 is available from our downloads page - [https://siren.io/downloads](https://siren.io/downloads) Happy Xmas! ---
**Author:** ![e.istomin](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/e.istomin/32/106_2.png) [@e.istomin](https://community.siren.io/u/e.istomin)\ **Post date:** [December 26, 2019, 8:49am UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/12 "2019-12-26T08:49:48Z")
Good joke 🙂 **Req:** …PUT /.siren HTTP/1.1 {“settings”:{“number\_of\_shards”:1},“mappings”:{“doc”:{“properties”:{“type”:{“type”:“keyword”},“updated\_at”:{“type”:“date”},… **ES 7.3 resp:** HTTP/1.1 400 Bad Request content-type: application/json; charset=UTF-8 content-length: 3462 {“error”:{“root\_cause”:[{“type”:“mapper\_parsing\_exception”,“reason”:"Root mapping definition has unsupported parameters: [doc : … ---
**Author:** ![jccq](https://yyz2.discourse-cdn.com/flex032/user_avatar/community.siren.io/jccq/32/12_2.png) [@jccq](https://community.siren.io/u/jccq)\ **Post date:** [January 11, 2020, 4:56pm UTC](https://community.siren.io/t/how-to-using-existing-elk-7-2-stack-as-data-source-with-siren-investigate/127/13 "2020-01-11T16:56:28Z")
Yes Mike was joking. Despite Federate being available for ES 7 investigate is not yet. It will be supported in Siren 10.5 the beta if which will be available in the next week’s