# about logs-to-elasticsearch.bro script

**URL:** <https://community.zeek.org/t/about-logs-to-elasticsearch-bro-script/4070>\
**Category:** Zeek\
**Created:** [March 24, 2016, 6:32am UTC](https://community.zeek.org/t/about-logs-to-elasticsearch-bro-script/4070 "2016-03-24T06:32:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![126](https://avatars.discourse-cdn.com/v4/letter/1/94ad74/32.png) [@126](https://community.zeek.org/u/126)\
**Post date:** [March 24, 2016, 6:32am UTC](https://community.zeek.org/t/about-logs-to-elasticsearch-bro-script/4070/1 "2016-03-24T06:32:02Z")

</div>

Dear all  
how to set **index** when use logs-to-elasticsearch.bro.

---

<div class="post-metadata">

**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\
**Post date:** [March 24, 2016, 9:26am UTC](https://community.zeek.org/t/about-logs-to-elasticsearch-bro-script/4070/2 "2016-03-24T09:26:33Z")

</div>

What do you mean with index ?

---

<div class="post-metadata">

**Author:** ![Grant\_Stavely](https://avatars.discourse-cdn.com/v4/letter/g/d78d45/32.png) [@Grant\_Stavely](https://community.zeek.org/u/Grant_Stavely)\
**Post date:** [March 24, 2016, 3:48pm UTC](https://community.zeek.org/t/about-logs-to-elasticsearch-bro-script/4070/3 "2016-03-24T15:48:24Z")

</div>

Hi ine,

In local.bro, redef the consts defined in [https://github.com/bro/bro-plugins/blob/9b7943e1a61062005f01b48eaad11bbb3b7ae757/elasticsearch/scripts/init.bro](https://github.com/bro/bro-plugins/blob/9b7943e1a61062005f01b48eaad11bbb3b7ae757/elasticsearch/scripts/init.bro), e.g.:

# Configure Elasticsearch

redef LogElasticSearch::server\_host = “x.x.x.x”;  
redef LogElasticSearch::server\_port= 9200;  
redef LogElasticSearch::cluster\_name = “security”;  
redef LogElasticSearch::index\_prefix = “bro”;  
redef LogElasticSearch::excluded\_log\_ids += {  
Known::HOSTS\_LOG,  
};

Grant

---

<div class="post-metadata">

**Author:** ![126](https://avatars.discourse-cdn.com/v4/letter/1/94ad74/32.png) [@126](https://community.zeek.org/u/126)\
**Post date:** [March 25, 2016, 1:30am UTC](https://community.zeek.org/t/about-logs-to-elasticsearch-bro-script/4070/4 "2016-03-25T01:30:22Z")

</div>

Dear

Index for Kibana.

---

<div class="post-metadata">

**Author:** ![126](https://avatars.discourse-cdn.com/v4/letter/1/94ad74/32.png) [@126](https://community.zeek.org/u/126)\
**Post date:** [March 25, 2016, 1:32am UTC](https://community.zeek.org/t/about-logs-to-elasticsearch-bro-script/4070/5 "2016-03-25T01:32:30Z")

</div>

Thanks very much

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/about-logs-to-elasticsearch-bro-script/4070/6 "2022-05-06T15:43:31Z")

</div>