Hi Experts,
I need some help. I have configure a conf file for logstash to listen on port 8443 to received ArcSight logs on cef format. I can see the connection from the Archsight connector to the the elk server via tcpdump. However, I can't see the logs been received by logstash.
Logstash cof file:
input {
tcp {
# The delimiter config used is for TCP interpretation
codec => cef { delimiter => "\r\n"}
port => 8443
type => syslog
}
}
filter {
To map the attacker Geo IP if plausible
geoip {
source => "sourceAddress"
target => "source"
}
To map the target Geo IP if plausible
geoip {
source => "destinationAddress"
target => "destination"
}
To map the log producing device Geo IP if plausible
geoip {
source => "deviceAddress"
target => "device"
}
}
output {
elasticsearch {
template_name => "cef"
template => "/etc/logstash/cef_template.json"
template_overwrite => false
index => "cef-%{+YYYY.MM.dd}"
#password => "changeme"
#user => "elastic"
}