Logstash to output syslog in Snare format

Hi All,

For a PoC portion, I would like to know whether logstash can output the syslogs in Snare format. Any reference?

If anyone has got insights around this, please shed some light here.

Thanks,
Ravi

Hii @Ravi342883.You can refer this link.This might help you.

Thanks you @Husnain ..
I think this config file talks about consuming (input) snare format logs, But, I'm looking for other way around (to output snare format).

Syslog -> Snare

Hii @Ravi342883.Np at all.I hope you will get the solution for this.

From what I can see, snare is just a set of fields that are tab separated. I think you could do that using a line codec with a format option

output { file { codec => line { format => "%{1stField} %{2ndField}..." ...} ... } }

where the separator in the format option is a tab character.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.