I am new to ELK and learning it now as part of my job. I am getting .cef logs from imperva waf that needs to be split in to fields so that it can be uploaded to the Elastic.
Please let me know how I can achieve this?
Is there any grok template that I can use?
Your help would be really appreciated.
I have configured the pipeline as mentioned in the document but I am getting the error message below:
Thread.exclusive is deprecated, use Thread::Mutex
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console ERROR: Failed to read pipelines yaml file. Location: /usr/share/logstash/config/pipelines.yml