How to format/filter events from syslog to send to auditbeat index


Audit beat is not supported on AIX. But I can send auth information to an syslog server.

I would like to write a filter that can send the syslog file to the audit beat index. Is there any guide how to do this?

kind regards

You would usually send Syslog to the Filebeat index. Filebeat has a Syslog input that you could use. Or, if you have your Syslog server write to log files on disk, you can use Filebeat with the Log input.

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.