Re: Zeek with ELK

--===============0245844767==
Content-Type: multipart/alternative; boundary="00000000000088ea27059b6eebbf"

--00000000000088ea27059b6eebbf
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

You can try rsyslog imfile module to send logs to logstash. The following
is my configuration.

$ModLoad imfile
$InputFileName /usr/local/bro/logs/current/dns.log
$InputFileTag dns:
$InputFileStateFile stat-dns
$InputFileSeverity info
$InputFileFacility local2
$InputRunFileMonitor

$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$MaxMessageSize 64k

sec-x sec-x <[email protected]> =E4=BA=8E2020=E5=B9=B41=E6=9C=885=E6=97=
=A5=E5=91=A8=E6=97=A5 =E4=B8=8B=E5=8D=8811:36=E5=86=99=E9=81=93=EF=BC=9A

> Hi,
>
> I recently used zeek IDS on FreeBSD 12.1 - Default Policy (GetTraffic
> from TAP on the network) and i want to send all the logs to ELK in
> realtime.
>
> I saw Filebeat ports on BSD is old and has problems.
>
> How can i send the logs from the BSD to the Elastic (what is the
> correct/best way)?
>
>
> Thanks,
>
> CM.
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>

--00000000000088ea27059b6eebbf
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">You can try rsyslog imfi=
le module to send logs to logstash. The following is my configuration.</div=
><div dir=3D"ltr"><br><div><div>$ModLoad imfile</div><div>$InputFileName /u=
sr/local/bro/logs/current/dns.log</div><div>$InputFileTag dns:</div><div>$I=
nputFileStateFile stat-dns</div><div>$InputFileSeverity info</div><div>$Inp=
utFileFacility local2</div><div>$InputRunFileMonitor</div><div><br></div><d=
iv>$SystemLogRateLimitInterval 0</div><div>$SystemLogRateLimitBurst 0</div>=
<div>$MaxMessageSize 64k</div></div></div></div></div><br><div class=3D"gma=
il_quote"><div dir=3D"ltr" class=3D"gmail_attr">sec-x sec-x &lt;<a href=3D"=
mailto:[email protected]">[email protected]</a>&gt; =E4=BA=8E2020=E5=
=B9=B41=E6=9C=885=E6=97=A5=E5=91=A8=E6=97=A5 =E4=B8=8B=E5=8D=8811:36=E5=86=
=99=E9=81=93=EF=BC=9A<br></div><blockquote class=3D"gmail_quote" style=3D"m=
argin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;borde=
r-left-color:rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
I recently used zeek IDS on FreeBSD 12.1 - Default Policy (GetTraffic<br>
from TAP on the network) and i want to send all the logs to ELK in<br>
realtime.<br>
<br>
I saw Filebeat ports on BSD is old and has problems.<br>
<br>
How can i send the logs from the BSD to the Elastic (what is the<br>
correct/best way)?<br>
<br>
<br>
Thanks,<br>
<br>
CM.<br>
_______________________________________________<br>
Zeek mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br>
<a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n=
oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi=
nfo/zeek</a><br>
</blockquote></div>

--00000000000088ea27059b6eebbf--

--===============0245844767==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============0245844767==--