# Logstash snort implementation

**URL:** <https://discuss.elastic.co/t/logstash-snort-implementation/32386>\
**Category:** Logstash\
**Created:** [October 16, 2015, 1:12pm UTC](https://discuss.elastic.co/t/logstash-snort-implementation/32386 "2015-10-16T13:12:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ssi](https://avatars.discourse-cdn.com/v4/letter/s/a3d4f5/32.png) [@ssi](https://discuss.elastic.co/u/ssi)\
**Post date:** [October 16, 2015, 1:12pm UTC](https://discuss.elastic.co/t/logstash-snort-implementation/32386/1 "2015-10-16T13:12:45Z")

</div>

have anyone made or heard of a snort plugin for logstash

i found this and will try it out sometime next week but if anyone have succeded in getting snort alerts parsed and into ELK I would really like to hear about how they went about it

> **[Snort, Logstash, Elastic Search and Kibana…](https://blog.jasonish.org/2014/04/16/snort-logstash-elastic-search-and-kibana/)**
>
> After having fun with Suricata’s new eve/json logging format and the Logstash/Elastic Search/Kibana combination (see this and this), I wanted to get my Snort events into Elastic Search as wel…

I have a security onion setup with snort and a feed from emergintthreats to generate alerts - i would like to add this to the mix of my current firewall log ELK stack.

best regards  
ps any tentative release date on filebeat?

---

<div class="post-metadata">

**Author:** ![cleesmith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cleesmith/32/6160_2.png) [@cleesmith](https://discuss.elastic.co/u/cleesmith)\
**Post date:** [November 25, 2015, 12:45pm UTC](https://discuss.elastic.co/t/logstash-snort-implementation/32386/2 "2015-11-25T12:45:18Z")

</div>

I am currently working on a new Beat (maybe called UnifiedBeat) to ship alerts from snort's unified2 files to ElasticSearch ... but I am just beginning and plan to start with FileBeat as a starting point (even though unified2 files are binary and not line delimited like syslogs).

Previously, I open sourced a python app on github called [uni2espy](https://github.com/cleesmith/uni2espy). It uses Jason Ish's [IdsTools](https://github.com/jasonish/py-idstools) to tail/read/parse snort's unified2 files and index the alerts into ElasticSearch.

Both should also work with Suricata which can create unified2 files.

For my usage I will prefer the Golang Beat version as it's easier to deploy and so on. But we have been using Uni2EsPy for over two years (it was only open sourced for a year now).

Just FYI.

---

<div class="post-metadata">

**Author:** ![8UDDY](https://avatars.discourse-cdn.com/v4/letter/8/6bbea6/32.png) [@8UDDY](https://discuss.elastic.co/u/8UDDY)\
**Post date:** [February 14, 2017, 8:00pm UTC](https://discuss.elastic.co/t/logstash-snort-implementation/32386/3 "2017-02-14T20:00:29Z")

</div>

Hey @cleesmith, Thank you for your UnifiedBeat contribution.

Any chance this is working on ELK (v5.1.2)? I am currently using Filebeat and either plain log or json files from securityonion boxen. Would love to get the unified2 logs from both snort and suricata instead. Thinking about building it out with UnifiedBeat, but figured I ask if this has been done before.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:28am UTC](https://discuss.elastic.co/t/logstash-snort-implementation/32386/4 "2017-07-06T04:28:36Z")

</div>