Bro IDS with ELK stack


(ruby) #1

I have configured BRO -IDS on PC along with Filebeat Shiipper

and from another PC on which I have installed ELK stack, I need to fetch BRO IDS logs.

please help to know what to configure on ELK stack..is there any need of python script ?


(Magnus Bäck) #2

It sounds like you want to configure Filebeat to ship the logs you're interested in to the host with Elasticsearch (and maybe Logstash).


(ruby) #3

yes, I have confiigured filebeat, but its is not shipping IDS logs to logstash


(Magnus Bäck) #4

Then I'd look in the Filebeat log for clues about what's going on.


(ruby) #5

{:timestamp=>"2017-02-16T14:30:11.539000+0530", :message=>"Beats input: the pipeline is blocked, temporary refusing new connection.", :reconnect_backoff_sleep=>0.5, :level=>:warn}

This is the error encountered


(Magnus Bäck) #6

That's the Logstash log, but okay. Why is Logstash's pipeline blocked then? There should be clues about that too.


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.