Filebeat module - auditd


(A G) #1

Hi,

I am using auditd module in Filebeat to send the audit logs to Logstash. Do I still need to parse the audit logs in Logstash? When I sent the output to elasticsearch everything was working fine but whenswitched to Logstash it is not parsing the data.

is there a auditd module configuration file available just like syslog (link is below)?

https://www.elastic.co/guide/en/logstash/current/logstash-config-for-filebeat-modules.html

Thanks,
Charan


(Carlos PĂ©rez Aradros) #2

Hi @charan.gandra,

I'm afraid Filebeat modules only work with Ingest node, if you are willing to use Logstash you can probably convert the pipeline from ingest to Logstash, as syntax is similar: https://github.com/elastic/beats/blob/master/filebeat/module/auditd/log/ingest/pipeline.json

Best regards


(A G) #3

Thank you.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.