<div dir="ltr"><div dir="ltr"><div dir="ltr">You can try rsyslog imfile module to send logs to logstash. The following is my configuration.</div><div dir="ltr"><br><div><div>$ModLoad imfile</div><div>$InputFileName /usr/local/bro/logs/current/dns.log</div><div>$InputFileTag dns:</div><div>$InputFileStateFile stat-dns</div><div>$InputFileSeverity info</div><div>$InputFileFacility local2</div><div>$InputRunFileMonitor</div><div><br></div><div>$SystemLogRateLimitInterval 0</div><div>$SystemLogRateLimitBurst 0</div><div>$MaxMessageSize 64k</div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">sec-x sec-x <<a href="mailto:center.mnt@gmail.com">center.mnt@gmail.com</a>> 于2020年1月5日周日 下午11:36写道：<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
I recently used zeek IDS on FreeBSD 12.1 - Default Policy (GetTraffic<br>
from TAP on the network) and i want to send all the logs to ELK in<br>
realtime.<br>
<br>
I saw Filebeat ports on BSD is old and has problems.<br>
<br>
How can i send the logs from the BSD to the Elastic (what is the<br>
correct/best way)?<br>
<br>
<br>
Thanks,<br>
<br>
CM.<br>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a><br>
</blockquote></div>