Bro-IDS and Logstash....a start (James Lay)

Hi
I am having trouble with logstash

I followed your direction but when I run
java -jar logstash-1.2.2-flatjar.jar agent -f logstash.conf – web

I got error message

The error reported is:
pattern %{BASE10NUM:unixtime} not defined

Sounds like you are missing the base patterns.

See:
https://github.com/logstash/logstash/blob/master/patterns/grok-patterns

  • Jeff

Run it again with sudo….you’ll most likely get another error, then, run it one more time…3rd time it will work. Why I have no idea :slight_smile:

James