Project

General

Profile

Actions
Copy link

Bug #1127

closed
VJ VJ

logstash & suricata parsing issue

Bug #1127: logstash & suricata parsing issue

Added by Victor Julien about 12 years ago. Updated about 12 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
2.0rc3
Affected Versions:
Effort:
Difficulty:
Label:

Description

Not yet sure where the problem is, but there is an issue with getting our json into logstash.

When using logstash-forwarder (formerly lumberjack), the tool adds a field "file", which contains the location of the log file it reads from:

"file": "/var/log/suricata/eve.json",

This then masks Suricata's 'file' section. So this appears to be a name space issue of some kind. After talking on #logstash (irc) I've reported in their bugtracker: https://logstash.jira.com/browse/LOGSTASH-1970
See also https://gist.github.com/inliniac/9399885

This may not be a Suricata issue, but we could work around it by choosing a different name for 'file'. However with other logstash transports other clashes may occur.

PM Updated by Peter Manev about 12 years ago Actions
Copy link
 #1

Is this occurring only when using the logstash forwarder?
I do not have the same problem when using it locally. Just confirming it is only a "forwarder" issue.

VJ Updated by Victor Julien about 12 years ago Actions
Copy link
 #2

It appears that when logstash reads in the file directly, it makes the file name available through the 'path' name instead of 'file'. This doesn't clash with our input. I do believe our message should be put in a "@message" 'container' in logstash, but in neither the direct or logstash-forwarder case this appears to be happening.

VJ Updated by Victor Julien about 12 years ago Actions
Copy link
 #3

  • Status changed from New to Closed
  • Assignee set to Victor Julien
  • Target version set to 2.0rc3
  • % Done changed from 0 to 100
Actions
Copy link

Also available in: PDF Atom