# I'm linking ELK to Snort. but there's been an error with the logstash **URL:** \ **Category:** Logstash\ **Created:** [June 24, 2020, 9:03pm UTC](https://discuss.elastic.co/t/im-linking-elk-to-snort-but-theres-been-an-error-with-the-logstash/238563 "2020-06-24T21:03:45Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![arse\_nal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arse_nal/32/45129_2.png) [@arse\_nal](https://discuss.elastic.co/u/arse_nal)\ **Post date:** [June 24, 2020, 9:03pm UTC](https://discuss.elastic.co/t/im-linking-elk-to-snort-but-theres-been-an-error-with-the-logstash/238563/1 "2020-06-24T21:03:46Z")
I'm linking ELK to Snort. there's been an error with the logstash But I can't figure out a way to deal with this error. Help me. I Use ELK 6.2.2, Centos 7, and snort 2.9.16. ![에러1](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c576da90e533a470802beef022413d51e72416ba.png) configure file code! ![코드1](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2fa0d261657aefb742c0cab28468815c892f4d32.png) ![2](https://us1.discourse-cdn.com/elastic/original/3X/5/b/5ba76186c187572eddbb58010ac1b78212cebb28.png) ![3](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6f078858bdf12dddca97ea16fdfc942a2f480d55.png) ![4](https://us1.discourse-cdn.com/elastic/original/3X/5/6/56c3c147c40e5a96b7392ee112296877d429cc45.png) ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 24, 2020, 9:34pm UTC](https://discuss.elastic.co/t/im-linking-elk-to-snort-but-theres-been-an-error-with-the-logstash/238563/2 "2020-06-24T21:34:32Z")
Please do not post pictures of text, just post the text itself. logstash is looking for a filter called data, which does not exist. Do you have a typo in the config for a date filter? ---
**Author:** ![arse\_nal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arse_nal/32/45129_2.png) [@arse\_nal](https://discuss.elastic.co/u/arse_nal)\ **Post date:** [June 25, 2020, 4:28am UTC](https://discuss.elastic.co/t/im-linking-elk-to-snort-but-theres-been-an-error-with-the-logstash/238563/3 "2020-06-25T04:28:43Z")
Here you go. Code! input { file { path =\> "/var/log/snort/alert" type =\> "snort\_tcp" start\_position =\> beginning ignore\_older =\> 0 sincedb\_path =\> "/dev/null" } file { path =\> "/opt/lampp/logs/access\_log" type =\> "access\_log" start\_position =\> beginning ignore\_older =\> 0 sincedb\_path =\> "/dev/null" } } filter{ if [type] == "snort\_tcp" { grok { add\_tag =\> ["IDS"] match =\> ["message", "%{SNORTIME:snort\_time}\s+[\*\*]\s+[%{INT:ids\_gid}:%{INT:ids\_sid}:%{INT:ids\_rev}]\s+[%{DATA:Attk\_Category}]\s+[%{DATA:Attk\_Level}]\s+%{DATA:Attk\_Name}\s+[\*\*]\s+[Classification:\s+%{DATA:ids\_classification}]\s+[Priority:\s+%{INT:priority}]\s+{%{WORD:ids\_proto}}\s+%{IP:src\_ip}:%{INT:src\_port}\s+-\>\s+%{IP:dst\_ip}:%{INT:dst\_port}"] } } date { match =\> ["snort\_time", "MM/dd-HH:mm:ss.SSSSSS"] } geoip { source =\> "src\_ip" target =\> "geoip\_snort\_src" } geoip { source =\> "dst\_ip" target =\> "geoip\_snort\_dst" } if [priority] == "1" { mutate { add\_field =\> {"severity" =\> "High & Medium & Low"} } } if [priority] == "2" { mutate { add\_field =\> {"severity" =\> "High & Medium"} } } if [ptiority] == " 3" { mutate { add\_field =\> {"severity" =\> "High & Low"} } } if [priority] == "4" { mutate { add\_field =\> {"severity" =\> "Medium & Low"} } } if [priority] == "5" { mutate { add\_field =\> {"severity" =\> "High"} } } if [priority] == "6" { mutate { add\_field =\> {"severity" =\> "Medium"} } } if [priority] == "7" { mutate { add\_field =\> {"severity" =\> "Low"} } } if [priority] == "8" { mutate { add\_field =\> {"severity" =\> "ETC"} } } } filter { if [type] == "access\_log" { grok { add\_tag =\> ["httpd"] match =\> ["message", "%{IPORHOST:clientip} %{USER:ident} %{USER:auth}[%{HTTPDATE:timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?:HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response}(?:%{NUMBER:bytes}I-) %{QS:referrer} %{QS:agent}"] } data { match =\> ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"] } mutate { convert =\> {"bytes" =\> "integer"} } geoip { source =\> "clientip" } mutate { convert =\> {"response" =\> "integer"} } } } output { if [type] == "snort\_tcp" { elasticsearch { hosts =\> ["localhost:9200"] # manage\_template =\> true index =\> "logstash-snort" } } if [type] == "access\_log" { elasticsearch { hosts =\> ["localhost:9200"] index =\> "logstash-httpd" } } } ---
**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\ **Post date:** [June 25, 2020, 4:33am UTC](https://discuss.elastic.co/t/im-linking-elk-to-snort-but-theres-been-an-error-with-the-logstash/238563/4 "2020-06-25T04:33:24Z")
> [@arse\_nal](#): > > data { > > match =\> ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"] > > } there's no filter plugin named data (as mentioned in your logstash error). this should be **date** , i believe ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 25, 2020, 4:06pm UTC](https://discuss.elastic.co/t/im-linking-elk-to-snort-but-theres-been-an-error-with-the-logstash/238563/5 "2020-06-25T16:06:47Z")
You could simplify the priority lookups using a translate filter. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 23, 2020, 4:06pm UTC](https://discuss.elastic.co/t/im-linking-elk-to-snort-but-theres-been-an-error-with-the-logstash/238563/6 "2020-07-23T16:06:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.