Phil Hagen

Multiple ES outputs results in resource overuse, per Elastic's guidance. Merge all ES outputs to one, using a variable for the index name, e.g. `index => "%{something}-%{+YYYY.MM.dd}"`

Create Community ID field for NetFlow

4

See https://github.com/corelight/community-id-spec

all ruby scripts used by Logstash parsers need tests added

consider EvtxToElk

3

See https://dragos.com/blog/20180717EvtxToElk.html

create tag for RFC1918, multicast, etc

3

use the `logstash-filter-cidr` plugin

likely with a scripted field

add RFC5424 (IETF) syslog format handling

8

LS provides separate RFC5424 grok parsers[1], meaning conditional support is needed for that, in conjunction with necessary field normalization. [1] https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/linux-syslog

add time frame to sof-elk_clear.py

1

add command line option to clear "last {x} {interval}" records from an index, or a specific date range. also, a means of deleting all EXCEPT the "last {x} {interval}" records.

same as with ES - need to identify good ratios and reserve overhead first