[Bro] filebeat +elk

[Michał Purzyński]

> On Mar 28, 2018, at 11:23 AM, Zeolla at GMail.com <zeolla at gmail.com> wrote:
> 
> No guarantees, but this[1] may be helpful.  I've recently moved to pushing things to kafka using this[2], which eventually feeds into ES using Apache Metron which adds some other benefits but is meant for large scale environments (i.e. it is definitely _not_ lightweight).
> 
> 1:  https://github.com/bro/bro-plugins/tree/00d039442b97ba545e6020200d96a3cba9d9181b/elasticsearch
> 2:  https://github.com/apache/metron-bro-plugin-kafka
> 
> Jon
> 
>> On Wed, Mar 28, 2018 at 2:21 PM erik clark <philosnef at gmail.com> wrote:
>> I just need to get it into ES. I am going to pump eve.json in as well. I have no experience with the ELK stack at all, other than some ES work from dealing with moloch content going in there and configuring it appropriately.
>> If I can just bypass everything and push eve.json and bro json logs directly in, that would be fantastic.
>> 
>> Thanks Jon!
>> 
>>> On Wed, Mar 28, 2018 at 1:09 PM, Zeolla at GMail.com <zeolla at gmail.com> wrote:
>>> Do you specifically need to send it to logstash or do you just need it to get inserted into elasticsearch?
>>> 
>>> Jon
>>> 
>>>> On Wed, Mar 28, 2018 at 1:07 PM erik clark <philosnef at gmail.com> wrote:
>>>> I am trying to ingest bro 2.5 json logs into an elk stack, using filebeat to push the logs. Is that even the best way to do this? I have found MUCH outdated material on ingesting bro logs into an elk stack, but very little that is up to date, and some of which is up to date but is using older versions of software from elastic.co. If anyone has a modern bro/elk integration document they use(d) to set their environment up, it would be greatly appreciated if you could share. Thanks!
>>>> 
>>>> Erik
>>>> _______________________________________________
>>>> Bro mailing list
>>>> bro at bro-ids.org
>>>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>>> -- 
>>> Jon
>>> 
>> 
> -- 
> Jon
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180328/17e94c5f/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image1.jpeg
Type: image/jpeg
Size: 64259 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180328/17e94c5f/attachment-0001.jpeg