Cef message split

Elastic Stack Logstash
1

Hi,

I am new to ELK and learning it now as part of my job. I am getting .cef logs from imperva waf that needs to be split in to fields so that it can be uploaded to the Elastic.
Please let me know how I can achieve this?
Is there any grok template that I can use?
Your help would be really appreciated.

Thanks
Rohit.

2

How are you receiving the CEF logs?

CEF logs can be decoded using a cef codec. There is an example of using it here.

3

The logs are in cef format from imperva waf and we are downloading it manually. I need some help in changing this cef format to json so that it can be uploaded to Elastic.

4

Do this have to be in two different files or can be in one .conf file

image
image699×242 6.14 KB

5

That would be in two different files, so that you have multiple pipelines configured using pipelines.yml.

6

I have configured the pipeline as mentioned in the document but I am getting the error message below:

sudo /usr/share/logstash/bin/logstash
Thread.exclusive is deprecated, use Thread::Mutex
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
ERROR: Failed to read pipelines yaml file. Location: /usr/share/logstash/config/pipelines.yml

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.