# Bro Elasticsearch 2+

**URL:** <https://community.zeek.org/t/bro-elasticsearch-2/3920>\
**Category:** Zeek\
**Created:** [November 27, 2015, 9:14pm UTC](https://community.zeek.org/t/bro-elasticsearch-2/3920 "2015-11-27T21:14:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\
**Post date:** [November 27, 2015, 9:14pm UTC](https://community.zeek.org/t/bro-elasticsearch-2/3920/1 "2015-11-27T21:14:09Z")

</div>

Hi,

I’ve been working a while on the elasticsearch integration with bro.  
There have been some issues like timestamp, the elstic 2.0 no dot  
and the name/type changes in the logging (version …). See my changes  
in [https://github.com/danielguerra69/bro-debian-elasticsearch/blob/master/Dockerfile](https://github.com/danielguerra69/bro-debian-elasticsearch/blob/master/Dockerfile)  
It was made pragmatic, some changes where just a quick hack.  
The latest release is stable.  
[https://hub.docker.com/r/danielguerra/bro-debian-elasticsearch/](https://hub.docker.com/r/danielguerra/bro-debian-elasticsearch/)

Regards,

Daniel

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [November 28, 2015, 1:16pm UTC](https://community.zeek.org/t/bro-elasticsearch-2/3920/2 "2015-11-28T13:16:57Z")

</div>

Thanks for this Daniel…I’ve been looking at the new ES as well…seems like a large pain now…this will help me out.

James

---

<div class="post-metadata">

**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\
**Post date:** [November 28, 2015, 1:47pm UTC](https://community.zeek.org/t/bro-elasticsearch-2/3920/3 "2015-11-28T13:47:11Z")

</div>

Hi,

Diving deeper in the problem, beside the dot & timestamp, it can be solved with bro config andelastic mapping. I didn’t find the exact place where the dot is placed in the fieldnames, but I found  
the point it was writing the json and changes [JSON.cc](http://json.cc) (ugly but pragmatic). About the bro script  
script structure there is a need for naming conventions and type. Like the version field which changes  
type all the time (ssl ssh socks etc.). Check /scripts/bro-map.sh for geo\_point and not analyzed fields (when  
you let elastic index the data it cuts the results into words). In this script also the shards and copies are set.  
Mapping needs to be done before writing.

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [November 29, 2015, 5:27am UTC](https://community.zeek.org/t/bro-elasticsearch-2/3920/4 "2015-11-29T05:27:06Z")

</div>

There may be more updates later, but I just pushed a fix for the fields in the SIP log that were accidentally strings instead of counts (along with some other cleanup).

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/bro-elasticsearch-2/3920/5 "2022-05-06T15:43:14Z")

</div>