Hi All,
On the new version of Logstash the ruby field references have changed.
As such the ruby code in the Logstash config here:
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/_Logstash_Kibana_and_Suricata_JSON_output
No longer works with the latest version.
The code is:
"if event['event_type'] == 'fileinfo'; event['fileinfo']['type']=event['fileinfo']['magic'].to_s.split(',')[0]; end;"
Which i modified to be:
"if event.get('event_type') == 'fileinfo'; event.set('fileinfo''type')=event.get('fileinfo''magic').to_s.split(',')[0]; end;"
Which causes Logstash to go into a reboot loop.
Having not touched ruby at all ever, can anyone see what I'm doing wrong here?