Is there anyone maintain the Kafka plugin

Zeek
1

I am using Zeek Kafka plugin (GitHub - SeisoLLC/zeek-kafka: A Zeek log writer plugin that publishes to Kafka.) and following the document to install the plugin manually.

But I encountered some issues when I deployed the cluster in ZeekCtl. I found other people encountered the same issue: @load packages/zeek-kafka can't find · Issue #80 · SeisoLLC/zeek-kafka · GitHub , seems nobody maintain this plugin now

2

Hey @josen - if you’re installing it manually rather than using zkg, you’ll need to use the following in your local.zeek file instead of packages/zeek-kafka

@load Seiso/Kafka

The packages/zeek-kafka load only works if you use zkg to install the plugin.

The plugin is actively maintained IIUC.

Hope that helps.

4

Now I am using the SASL authentication, the script I used is:

@load Seiso/Kafka
redef Kafka::topic_name = "";
redef Kafka::tag_json = T;

event zeek_init() &priority=-10
{
  local http_filter: Log::Filter = [
    $name = "kafka-http",
    $writer = Log::WRITER_KAFKAWRITER,
    $config = table(
      ["metadata.broker.list"] = "xxx.xxx.xxx.xxx:9093"
      , ["security.protocol"] = "SASL_PLAINTEXT"
      , ["sasl.mechanism"] = "PLAIN"
      , ["sasl.username"] = "username",
      , ["sasl.password"] = "password"
    ),
    $path = "http"
  ];
  Log::add_filter(HTTP::LOG, http_filter);
}

Nothing is sent to Kafka broker.
Is there anything wrong here?

5

Thanks Awelzel, it is working now.

Hey @josen - I had that in my mailbox. Has it worked without authentication at first? If yes, you might want to check if you can use kcat with the same credentials etc and/or if there’s any logs on the Kafka side that indicate auth failures. Just to exclude it’s actually an issue with the plugin. If you can verify it’s a problem with the plugin, a GitHub issue in the plugin’s repo might be a right step.

6

Thanks Awelzel, I will follow your suggestion.