Hi Logstash Ninja Masters,
I’m using an instance of Logstash (Docker container version 7.4.0, yes, I know I need to upgrade) that is currently processing our network data. Here’s a sample data record:
“10.10.10.10”, “220.127.116.11”, “TCP”, “80”, “12345”, “2000”
Meaning “Host 10.10.10.10 sent 2,000 bytes to host 18.104.22.168 over TCP ports 80 and 12345.” Simple, networking-101 type stuff.
But what I’d like to do is translate all of this into more meaningful data. nDPI is a C library which can translate the above data and turn it into:
“10.10.10.10”, “HTTP”, “www.google.com”, “2000”
…which is much more meaningful.
Unfortunately, the nDPI library looks like it is only written in C. The question is, how can Logstash interact with a C library?
I’m tempted to write a standalone C program that could query the nDPI library on a per-need basis. Then, perhaps Logstash could query my C program through a network call, or something? I’m not sure what is the best approach. Another consideration: nDPI would return a struct containing lots of information, so I’d have to devise a way to transfer all that information out of my C program and back into Logstash.
But before I invest what would probably be significant development time, I’d like to ask the forum: is the best way? Can someone recommend any other approach? Any advice will be appreciated.