sof-elk
sof-elk copied to clipboard
philhagen
Configuration files for the SOF-ELK VM
install the LS Google pub/sub input plugin and provide instructions on getting data from GCP. "Option 2" here: https://cloud.google.com/solutions/exporting-stackdriver-logging-elasticsearch#configure_logstash Requires plugin addition: https://www.elastic.co/guide/en/logstash/7.11/plugins-inputs-google_pubsub.html Configuration files will need to include a...
The JSON output mode for `nfdump` should provide a better (faster?) and more streamlined processing pipeline than CSV. Some sample records are below. One potential optimization that would be useful...
Hi Phil, Is there a way to manually upload IIS logs instead of ingesting using FileBeat? I noticed the httpd directory only accepts apache logs. Cheers
Hi, Currently working on importing plaso timeline csv into ELK, but it seems that not all events get their event id, computername,.. extracted out of it. Will try to fix...
Multiple ES outputs results in resource overuse, per Elastic's guidance. Merge all ES outputs to one, using a variable for the index name, e.g. `index => "%{something}-%{+YYYY.MM.dd}"`
See https://github.com/corelight/community-id-spec
Have the update script let you know if you need to download the new VM version.
