Bro IDS with ELK stack

(ruby) #1

I have configured BRO -IDS on PC along with Filebeat Shiipper

and from another PC on which I have installed ELK stack, I need to fetch BRO IDS logs.

please help to know what to configure on ELK there any need of python script ?

(Magnus Bäck) #2

It sounds like you want to configure Filebeat to ship the logs you're interested in to the host with Elasticsearch (and maybe Logstash).

(ruby) #3

yes, I have confiigured filebeat, but its is not shipping IDS logs to logstash

(Magnus Bäck) #4

Then I'd look in the Filebeat log for clues about what's going on.

(ruby) #5

{:timestamp=>"2017-02-16T14:30:11.539000+0530", :message=>"Beats input: the pipeline is blocked, temporary refusing new connection.", :reconnect_backoff_sleep=>0.5, :level=>:warn}

This is the error encountered

(Magnus Bäck) #6

That's the Logstash log, but okay. Why is Logstash's pipeline blocked then? There should be clues about that too.

(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.