Zeek Module - Custom Zeek Install Location

Elastic Stack Beats
1

I have installed Zeek at a custom location, how can I configure the Zeek module in FileBeats to collect the logs from the proper log location?

2

Hi @MrTrav,

You can customize the paths used by filebeat by setting the var.paths option on each fileset. If this is not working for you, could you paste the configuration you are using?

3

Here is my configuration, not seeing anything output to console.

filebeat.inputs:

- type: log

  enabled: false

  paths:
    - /opt/nsm/zeek/logs/current/*

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 1

#output.elasticsearch:
  #hosts: ["localhost:9200"]

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

filebeat.modules:
- module: zeek
  # All logs
  connection:
    enabled: true
  dns:
    enabled: true
  http:
    enabled: true
  files:
    enabled: true
  ssl:
    enabled: true
  notice:
    enabled: true

    var.paths:
      - /opt/nsm/zeek/logs/current/conn.log

output.console:
  pretty: true
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.