How to apply predefined template if log collection is done in a different way

Elastic Stack Kibana
1

Hey Fellas,

I need to collect suricata logs from a machine. By default suricata has a template in kibana if logs collected with filebeat and suricata filebeat module is installed, dashboards are created automatically. Stuffs are taken care...!

But

I dont have a provision to collect logs via Filebeat due to a special case.
All I can afford is sending logs to a logstash syslog input plugin.
How to apply the suricata default dashboard to interpret the logs collected by suricata automatically to a custom index name.

Regards
Karthik. K

2

Hi

You have to take care, that logstash transforms the data in the same schema filebeat would, and save it also in the same index. then the dashboard should work

Best,
Matthias

3

Hi matw,

Thanks for the quick response. I have given a thought about it but the situation demands a custom name for the index as I have already specified.

Can you give a thought or a tweak which will make this possible ?

Any guidance is very much appreciated.

Regards
Karthik.K

4

You can write to a different index or create a specific index name. Please refer the Logstash Elasticsearch Output plugin documentation here

5

Aravind,

I do understand that we can write to different indexes with different names using logstash no doubt in that. My question is if I'm writing to a index with a different name also. How can I used the default suricata dashboard provided by ELK SIEM to read and populate data from that custom named index. I wonder If we can do some tweakings to achieve this.

Thanks
Karthik. K

6

Well, you can create a index pattern to make the dashboard use the data from multiple indexes.
For ex: if you indexes named "surcata-es" and "surcata-mine", you can create an index pattern with "surcata-*" in kibana.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.