# Filebeat sends encrypted logs from snort to elastic

**URL:** <https://discuss.elastic.co/t/filebeat-sends-encrypted-logs-from-snort-to-elastic/315625>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [October 2, 2022, 5:01am UTC](https://discuss.elastic.co/t/filebeat-sends-encrypted-logs-from-snort-to-elastic/315625 "2022-10-02T05:01:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mahmoudmaani](https://avatars.discourse-cdn.com/v4/letter/m/91b2a8/32.png) [@mahmoudmaani](https://discuss.elastic.co/u/mahmoudmaani)\
**Post date:** [October 2, 2022, 5:01am UTC](https://discuss.elastic.co/t/filebeat-sends-encrypted-logs-from-snort-to-elastic/315625/1 "2022-10-02T05:01:15Z")

</div>

Hello,

Snort logs on Kibana are encrypted as you can see below. Even when I try to run `cat /var/log/snort/snort.log.166425312` on snort itself I will get the same output.

 ![Screen Shot 2022-10-02 at 12.51.00 AM](https://us1.discourse-cdn.com/elastic/original/3X/2/0/205973cb6f3eac905b09c77ce7eb1ee89a143207.png)

The only way to show the output is by running `tcpdump -r /var/logs/snort/snort.log.166425312` on Snort server.

Do you have any idea how to decrypt the message on Kibana or at least how to convert the logs into json and then ship it to elastic?

My snort.yml

```auto
# Module: snort
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.16/filebeat-module-snort.html

- module: snort
  log:
    enabled: true

    # Set which input to use between udp (default), tcp or file.
    # var.input: file
    # var.syslog_host: localhost
    # var.syslog_port: 9532

    # Set paths for the log files when file input is used.
    var.paths: ["/var/log/snort/snort.log.*"]

    # Toggle output of non-ECS fields (default true).
    # var.rsa_fields: true

    # Set custom timezone offset.
    # "local" (default) for system timezone.
    # "+02:00" for GMT+02:00
    # var.tz_offset: local

```

* * *

my filebeat.yml

```auto
filebeat.inputs:

- type: log
  enabled: true
  paths:
    - /var/log/snort/snort.log.*

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:
  host: "elastic:5601"

output.elasticsearch:
  hosts: ["elastic:9200"]
  username: "elastic"
  password: "elastic"

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

setup.ilm.overwrite: true

```

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [October 3, 2022, 7:21am UTC](https://discuss.elastic.co/t/filebeat-sends-encrypted-logs-from-snort-to-elastic/315625/2 "2022-10-03T07:21:05Z")

</div>

@Marius_Iversen or @andrewkroh do you know if this is supported by this module?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 31, 2022, 7:21am UTC](https://discuss.elastic.co/t/filebeat-sends-encrypted-logs-from-snort-to-elastic/315625/3 "2022-10-31T07:21:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.