Feature #1978: Using date in logs name - Suricata - Open Information Security Foundation

Custom queries

Good First Issues
OISF community

Actions

Copy link

Feature #1978

closed

Using date in logs name

Added by Timofey Titovets over 7 years ago. Updated about 7 years ago.

Status:

Closed

Priority:

Low

Assignee:

Mats Klepsland

Target version:

4.0beta1

Effort:

Difficulty:

Label:

Description

Hi, i just want support thing something like:
filename: eve-alert-%{+xx.MM.dd}.json

History
Notes
Property changes

Actions

Copy link

Updated by Victor Julien over 7 years ago

Status changed from New to Assigned
Assignee set to Jason Ish
Target version set to TBD

I think this could be nice.

Actions

Copy link

Updated by Jason Ish over 7 years ago

What about posix style strftime formatting: eve-alert-%y.%m.%d.

I'm going to guess that automatically rolling over the file at midnight would be desired behaviour as well when formatting the date this way?

Actions

Copy link

Updated by Timofey Titovets over 7 years ago

Jason Ish wrote:

What about posix style strftime formatting: eve-alert-%y.%m.%d.

I'm going to guess that automatically rolling over the file at midnight would be desired behaviour as well when formatting the date this way?

Yes, it's okay.

Thanks.

Actions

Copy link

Updated by Jason Ish about 7 years ago

Status changed from Assigned to Closed
Target version changed from TBD to 4.0beta1

Git master now has the ability to put dates in the eve log file names.

PR: https://github.com/inliniac/suricata/pull/2633

http://suricata.readthedocs.io/en/latest/output/eve/eve-json-output.html#date-modifiers-in-filename

Its important to note that when using a naming scheme, Suricata will open new files as needed, with the new date but will not remove the old ones. That is up to you.

Actions

Copy link

Updated by Victor Julien about 7 years ago

Assignee changed from Jason Ish to Mats Klepsland

Actions

Copy link

Also available in: Atom PDF

Project

General

Profile

Suricata

Custom queries

Feature #1978

Using date in logs name

Updated by Victor Julien over 7 years ago

Updated by Jason Ish over 7 years ago

Updated by Timofey Titovets over 7 years ago

Updated by Jason Ish about 7 years ago

Updated by Victor Julien about 7 years ago