Project

General

Profile

Actions
Copy link

Support #2660

closed

structing fast.log and store to elasticsearch

Added by Hao Han over 5 years ago. Updated about 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
4.0.5
Label:

Description

As we all know that eve.json can be outputed as json to redis. Then logstash can be used to pull the structured data from redis to elasticsearch.
And I still need to store the fast.log to elasticsearch. How can I structuring fast.log and output the structed data to elasticsearch?

Actions
Copy link
 #1

Updated by Victor Julien over 5 years ago

out of curiosity: why would you want this? The eve.alert records are trivial to pass to ES, with fast.log you will need to some kind of parsing before passing it to ES somehow

Actions
Copy link
 #2

Updated by Hao Han over 5 years ago

Victor Julien wrote:

out of curiosity: why would you want this? The eve.alert records are trivial to pass to ES, with fast.log you will need to some kind of parsing before passing it to ES somehow

Thanks your replies. We want to visualize suricata's alerts with kibana.

Actions
Copy link
 #3

Updated by Victor Julien over 5 years ago

I not sure I understand why you wouldn't just use the EVE alert records for this.

Actions
Copy link
 #4

Updated by Bryant Smith about 5 years ago

If you are still looking for a solution here, splitting out the alert might be helpful. the eve.json will be much easier to implement in an ELK stack and this way you can send it only the alerts if that is what you are looking for.

https://suricata.readthedocs.io/en/suricata-4.1.2/output/eve/eve-json-output.html#multiple-logger-instances

outputs:
  - eve-log:
      enabled: yes
      type: file
      filename: eve-ips.json
      types:
        - alert
        - drop
Actions
Copy link
 #5

Updated by Victor Julien about 5 years ago

  • Status changed from New to Closed
Actions
Copy link

Also available in: Atom PDF