Zeek module - other logs

hi, i'm using filebeat with the zeek module to transfer logs to logstash then on to ES.

as of now it looks like the zeek module only handles about 5 of the zeek logs (the common ones: conn, dns, http, files, ssl, notice)

whats the best approach to getting the other logs into es?
i see the module folder under /var/lib/filebeat..
Do i just create my own modules for each of the other kinds of files (i need modbus, and weird.log)

or do i just specifically monitor those logs the standard filebeat way, and write some logstash parsers to parse them?

thanks

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.