Arcsight Logs do not Ouput to Kibana

Hi Experts,

I need some help. I have configure a conf file for logstash to listen on port 8443 to received ArcSight logs on cef format. I can see the connection from the Archsight connector to the the elk server via tcpdump. However, I can't see the logs been received by logstash.
Logstash cof file:

input {
tcp {
# The delimiter config used is for TCP interpretation
codec => cef { delimiter => "\r\n"}
port => 8443
type => syslog
}
}

filter {

To map the attacker Geo IP if plausible

geoip {
source => "sourceAddress"
target => "source"
}

To map the target Geo IP if plausible

geoip {
source => "destinationAddress"
target => "destination"
}

To map the log producing device Geo IP if plausible

geoip {
source => "deviceAddress"
target => "device"
}

}

output {

elasticsearch {
template_name => "cef"
template => "/etc/logstash/cef_template.json"
template_overwrite => false
index => "cef-%{+YYYY.MM.dd}"
#password => "changeme"
#user => "elastic"
}

Have you tried simplifying the setup by using a stdout { codec => rubydebug } output instead of the elasticsearch output? Have you looked in the Logstash logs for clues?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.