# Frontend **URL:** \ **Category:** Zeek\ **Created:** [October 22, 2013, 4:57pm UTC](https://community.zeek.org/t/frontend/2867 "2013-10-22T16:57:11Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 22, 2013, 4:57pm UTC](https://community.zeek.org/t/frontend/2867/1 "2013-10-22T16:57:11Z")
Hey all! So...I'm looking for SOMETHING that will allow me to parse and aggregate bro, snort, and firewall logs. I've looked at logstash, but the latest version seems poorly documented...everything that I wanted to try took ages to figure out. Anyone have anything that will accomplish something like this? Thanks all. James ---
**Author:** ![Doug\_Burks](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@Doug\_Burks](https://community.zeek.org/u/Doug_Burks)\ **Post date:** [October 22, 2013, 5:14pm UTC](https://community.zeek.org/t/frontend/2867/2 "2013-10-22T17:14:04Z")
Hi James, Have you considered ELSA? [https://code.google.com/p/enterprise-log-search-and-archive/wiki/Documentation](https://code.google.com/p/enterprise-log-search-and-archive/wiki/Documentation) Also see: [https://www.youtube.com/watch?v=33HZyIxbg6c&list=PLMN5wm-C5YjyieO63g8LbaiWTSJRj0DBe](https://www.youtube.com/watch?v=33HZyIxbg6c&list=PLMN5wm-C5YjyieO63g8LbaiWTSJRj0DBe) ---
**Author:** ![Jeremy\_Hoel](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@Jeremy\_Hoel](https://community.zeek.org/u/Jeremy_Hoel)\ **Post date:** [October 22, 2013, 5:16pm UTC](https://community.zeek.org/t/frontend/2867/3 "2013-10-22T17:16:17Z")
splunk -) And Security onion uses Elsa to do the same thing. Elsa is just a moving target (changes a lot) but Martin is doing an awesome job fixing things, adding features and helping people out. Elsa has the benefit of being free with no limits, vs splunk 500mb/day ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 22, 2013, 5:17pm UTC](https://community.zeek.org/t/frontend/2867/4 "2013-10-22T17:17:04Z")
Thanks for the ELSA recommendations all...giving it a look now. James ---
**Author:** ![Eric\_G](https://avatars.discourse-cdn.com/v4/letter/e/258eb7/32.png) [@Eric\_G](https://community.zeek.org/u/Eric_G)\ **Post date:** [October 22, 2013, 5:26pm UTC](https://community.zeek.org/t/frontend/2867/5 "2013-10-22T17:26:41Z")
Splunk on the commercial side, ELSA on the free side would be my suggestions without hearing more details about your environment or needs On the free side you’re going to spend time setting them up and getting stuff configured… That’s the price of the open source log aggregation stuff out there… ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 22, 2013, 5:29pm UTC](https://community.zeek.org/t/frontend/2867/6 "2013-10-22T17:29:11Z")
Thanks Eric...something that lifts my spirits: Plugins ELSA ships with several plugins:      Windows logs from Eventlog-to-Syslog      Snort/Suricata logs      Bro logs      Url logs from httpry\_logger So THAT helps...I won't have to reinvent anything. Documentation looks pretty tasty as well, so let's hope it's not too much of a hassle. I'll report my success/failures here. James ---
**Author:** ![Eric\_G](https://avatars.discourse-cdn.com/v4/letter/e/258eb7/32.png) [@Eric\_G](https://community.zeek.org/u/Eric_G)\ **Post date:** [October 22, 2013, 5:35pm UTC](https://community.zeek.org/t/frontend/2867/7 "2013-10-22T17:35:54Z")
I think there are parsers for a couple of firewall vendors too. I would be open to helping ya get a parser written if there isn’t one for whatever firewall solution you’re using. ELSA’s a really neat project, so it’d be cool to help it out ---
**Author:** ![Eric\_G](https://avatars.discourse-cdn.com/v4/letter/e/258eb7/32.png) [@Eric\_G](https://community.zeek.org/u/Eric_G)\ **Post date:** [October 22, 2013, 5:39pm UTC](https://community.zeek.org/t/frontend/2867/8 "2013-10-22T17:39:46Z")
Yup looks like plugins for a few different vendors have been written: " By popular demand, I’ve added a number of new parsers to the ELSA repertoire to support parsing fields from the following devices: - Fortinet (URL, traffic) - Checkpoint - Palo Alto (URL, traffic) - Barracuda (scan, receive, send) - OSSEC Windows logs (automatically appears as class Windows)" (from [http://ossectools.blogspot.com/2012/02/new-elsa-log-parsers.html](http://ossectools.blogspot.com/2012/02/new-elsa-log-parsers.html)) ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:41pm UTC](https://community.zeek.org/t/frontend/2867/9 "2022-05-06T15:41:19Z")