I've been on a mission the last few weeks to get ElasticStack to ingest DMARC's aggregate reports that come from remote mail domains as compressed xml files. From the onset, one of the goals I had was to build something that was as "plug n play" as possible. I'm nearly complete, just a few more items to work out, hoping someone here can guide me through these.
- Decompression of archives
- Restructuring of XML documents
- Ingest/Parse into ElasticStack
- Automatic Template Setup
- Automatic Index Creation
- Index Pattern Formatting
Automatic Template Setup
I have a custom template already configured and functional. Outside of using Kibana's dev console to copy/paste the template, what other methods do we have?
Automatic Index Creation
Is there a way, to have the index created automatically?
Index Pattern Formatting
There are IP fields using the datatype geo_point. I have these fields, along with a few others, formatted in Kibana as URLs that redirect to a WHOIS lookup service. Is there a way to do this kind of formatting automatically?