[Bro] Couple elasticsearch questions

[James Lay]

On Wed, 2014-07-23 at 20:39 -0400, Mike Waite wrote:
> Take a look at 
> 
> http://brostash.herokuapp.com/
> 
> -Mike
> 
> On 7/23/14, 11:50 AM, James Lay wrote:
> 
> > I'm guessing I'm going to have to create something like the above grok 
> > for each bro log file....which...is going to be a hoot ;)  I was hoping 
> > that work was already done somewhere...and I think I had it working at 
> > one time for conn.log that I posted here some time ago.  Thanks 
> > again...after looking at the Brownian source I think I'm going to have 
> > to just bite the bullet and generate the grok lines.
> > 
> > James
> > 
> > _______________________________________________
> > Bro mailing list
> > bro at bro-ids.org
> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> > 
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro

Yea that's a thing of beauty...thank you!

James