How to format/filter events from syslog to send to auditbeat index

Elastic Stack Beats
1

Hi,

Audit beat is not supported on AIX. But I can send auth information to an syslog server.

I would like to write a filter that can send the syslog file to the audit beat index. Is there any guide how to do this?

kind regards

2

You would usually send Syslog to the Filebeat index. Filebeat has a Syslog input that you could use. Or, if you have your Syslog server write to log files on disk, you can use Filebeat with the Log input.

3

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.