Hi All,
For a PoC portion, I would like to know whether logstash can output the syslogs in Snare format. Any reference?
If anyone has got insights around this, please shed some light here.
Thanks,
Ravi
Hi All,
For a PoC portion, I would like to know whether logstash can output the syslogs in Snare format. Any reference?
If anyone has got insights around this, please shed some light here.
Thanks,
Ravi
Hii @Ravi342883.You can refer this link.This might help you.
Thanks you @Husnain ..
I think this config file talks about consuming (input) snare format logs, But, I'm looking for other way around (to output snare format).
Syslog -> Snare
Hii @Ravi342883.Np at all.I hope you will get the solution for this.
From what I can see, snare is just a set of fields that are tab separated. I think you could do that using a line codec with a format option
output { file { codec => line { format => "%{1stField} %{2ndField}..." ...} ... } }
where the separator in the format option is a tab character.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.