Grok for auditbeat log

Elastic Stack Beats
1

Hi , I'm trying to set grok for auditbeat pipeline but getting grokparsefailure

maybe someone has a sample audit grok configuration ?

thanks in advance.

2

You are trying to ingest the log output from Auditbeat? I suggest configuring the Beat to output JSON logs. That should make it easier to parse.

https://www.elastic.co/guide/en/beats/auditbeat/current/configuration-logging.html#_logging_json

logging.json: true

3

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.