I have configured BRO -IDS on PC along with Filebeat Shiipper
and from another PC on which I have installed ELK stack, I need to fetch BRO IDS logs.
please help to know what to configure on ELK stack..is there any need of python script ?
It sounds like you want to configure Filebeat to ship the logs you're interested in to the host with Elasticsearch (and maybe Logstash).
yes, I have confiigured filebeat, but its is not shipping IDS logs to logstash
Then I'd look in the Filebeat log for clues about what's going on.
{:timestamp=>"2017-02-16T14:30:11.539000+0530", :message=>"Beats input: the pipeline is blocked, temporary refusing new connection.", :reconnect_backoff_sleep=>0.5, :level=>:warn}
This is the error encountered
That's the Logstash log, but okay. Why is Logstash's pipeline blocked then? There should be clues about that too.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.