Filebeat read only one folder

I got filebeat running on a pfsense box (using pkgadd beat package):

filebeat version 5.4.3 (amd64), libbeat 5.4.3

I have configured my filebeat agent to grab logs from a path where logs from 2 snort interfaces are located:

ls -alrt /var/log/snort/
total 39
drwxr-xr-x  4 root  wheel      5 Feb  7 22:38 .
drwxr-xr-x  8 root  wheel     32 Feb  9 18:55 ..
-rw-r--r--  1 root  wheel  67093 Feb 27 12:04 snort_rules_update.log
drwxr-xr-x  3 root  wheel      8 Feb 27 12:06 snort_em1.536159
drwxr-xr-x  3 root  wheel      6 Feb 27 12:31 snort_pppoe064290

in each snort folders, an alert file is present which contains the alerts:

[2.4.2-RELEASE][admin@pf]/root: tail -1 /var/log/snort/snort_em1.536159/alert
02/27/18-17:46:12.794270 ,119,33,1,"(http_inspect) UNESCAPED SPACE IN HTTP URI",TCP,,21103,,3128,0,Unknown Traffic,3

    [2.4.2-RELEASE][admin@pf]/root: tail -1 /var/log/snort/snort_pppoe064290/alert
    02/27/18-17:20:05.848441 ,140,26,1,"(spp_sip) Method is unknown",UDP,,5102,,5060,48979,Potentially Bad Traffic,2

Here is my filebeat.yml config:

#------------------------- File prospectors --------------------------------
- input_type: log
    - /var/log/snort/*/alert
  tags: ["snort_ips"]
  fields_under_root: true
    type: "snort"
  document_type: snort

#----------------------------- Logstash output --------------------------------
  hosts: [""]

#---------------------------- filebeat logging -------------------------------

logging.to_files: true
  path: /var/log/filebeat
  name: filebeat.log
  keepfiles: 7

For an unknown reason only the /var/log/snort/snort_em1.536159/alert file seems to be scan by the filebeat agent. On my remote logstash destination and in kibana I can't see any events from the pppoe interface and the filebeat logs do not see any mention of an event seen in the snort's pppoe interface...

Any idea?

Can you enable debug looging in filebeat and share the output here. This should give us more details on what is happening.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.