Suricata module question

Elastic Stack Beats
1

Hi!

In my setup, the "eve" log files are separated by category.

Using the Suricata module, how can I send both eve files to elastic? is it possible to use the example below?

- module: suricata
  eve:
    enabled: true
    var.paths: ["/my/path/suricata-events.json"]
    var.paths: ["/my/path/suricata-alerts.json"]
2

Try this:

- module: suricata
  eve:
    enabled: true
    var.paths:
      - "/my/path/suricata-events.json"
      - "/my/path/suricata-alerts.json"
3

Many thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.