# redef LogElasticSearch variables **URL:** \ **Category:** Zeek\ **Created:** [February 25, 2013, 8:45pm UTC](https://community.zeek.org/t/redef-logelasticsearch-variables/2569 "2013-02-25T20:45:19Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jessebowling](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@jessebowling](https://community.zeek.org/u/jessebowling)\ **Post date:** [February 25, 2013, 8:45pm UTC](https://community.zeek.org/t/redef-logelasticsearch-variables/2569/1 "2013-02-25T20:45:19Z")
Let me preface this with “I have no idea what I’m doing”. I want to test out Bro’s native elasticsearch writer…I found that there appear to be two files for this module: bro/base/frameworks/logging/writers/elasticsearch.bro bro/policy/tuning/logs-to-elasticsearch.bro Both of them specify that the module is called “LogElasticSearch”…Is that a problem? At any rate… I want to specify an ElasticSearch server that is not local. I didn’t see any documentation on this, but saw that elasticsearch.bro has variables like “server\_host”. Seems like this would be the thing to change…So, I tried: @load tuning/logs-to-elasticsearch redef LogElasticSearch::server\_host = “10.10.10.10” It appears that broctl does not like this invocation. Specifically it chokes and says: error in /usr/local/bro/share/bro/policy/frameworks/communication/listen.bro, line 6: syntax error, at or near “module” Which is weird…If I put additional redef’s: @load tuning/logs-to-elasticsearch redef LogElasticSearch::server\_host = “10.9.12.26” redef LogElasticSearch::server\_port= 9200 I then get: error in /usr/local/bro/share/bro/site/local.bro, line 113: syntax error, at or near “redef” (line 113 is the last redef of server\_port). So…What am I doing wrong and how do I configure this plugin to point to another host? Is that book on brogramming out yet? 😛 Cheers, Jesse ---
**Author:** ![Azoff\_Justin](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@Azoff\_Justin](https://community.zeek.org/u/Azoff_Justin)\ **Post date:** [February 25, 2013, 8:50pm UTC](https://community.zeek.org/t/redef-logelasticsearch-variables/2569/2 "2013-02-25T20:50:28Z")
The redef line is missing a semicolon. The error when you leave off a semicolon can be confusing since you get the error after that line. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 25, 2013, 8:56pm UTC](https://community.zeek.org/t/redef-logelasticsearch-variables/2569/3 "2013-02-25T20:56:25Z")
> bro/base/frameworks/logging/writers/elasticsearch.bro This is the script level support for the elasticsearch writer. > bro/policy/tuning/logs-to-elasticsearch.bro This is a utility script to help you send your logs to ElasticSearch. It has some tuning options so you can choose if you only want to send certain logs. > Both of them specify that the module is called "LogElasticSearch"...Is that a problem? At any rate… Defining a module only sets that to your current namespace. You can define it multiple times. I believe Justin answered the rest of your question. 🙂   .Seth ---
**Author:** ![jessebowling](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@jessebowling](https://community.zeek.org/u/jessebowling)\ **Post date:** [February 25, 2013, 8:57pm UTC](https://community.zeek.org/t/redef-logelasticsearch-variables/2569/4 "2013-02-25T20:57:14Z")
Ah yes, syntax… 🙂 Thank you all, that checks out ok. Cheers, Jesse ---
**Author:** ![Fair\_Charles\_A\_SSG\_U](https://avatars.discourse-cdn.com/v4/letter/f/9de053/32.png) [@Fair\_Charles\_A\_SSG\_U](https://community.zeek.org/u/Fair_Charles_A_SSG_U)\ **Post date:** [February 27, 2013, 4:45pm UTC](https://community.zeek.org/t/redef-logelasticsearch-variables/2569/5 "2013-02-27T16:45:14Z")
Classification: UNCLASSIFIED Caveats: NONE Seth, We spoke at the 2012 Bro Exchange about how Bro can be used on a filesystem of a host or such, brain a bit fuzzy this early in the morning at 10:36 🙂 Could you expand on the topic a bit/point me in the right direction? Thanks, SSG Charles "Chuck" A. Fair (not a CISSP, but passed the test) Information Systems/Information Assurance NCO Information Technology Training Center, PEC, Camp Robinson AR Classification: UNCLASSIFIED Caveats: NONE ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 27, 2013, 4:52pm UTC](https://community.zeek.org/t/redef-logelasticsearch-variables/2569/6 "2013-02-27T16:52:27Z")
How are you looking to use it? We have the input framework in 2.1 for reading from inputs that we have plugins for (essentially only Bro logs and text files right now). We may have quite a bit more functionality regarding that in 2.2.   .Seth ---
**Author:** ![Fair\_Charles\_A\_SSG\_U](https://avatars.discourse-cdn.com/v4/letter/f/9de053/32.png) [@Fair\_Charles\_A\_SSG\_U](https://community.zeek.org/u/Fair_Charles_A_SSG_U)\ **Post date:** [February 27, 2013, 5:03pm UTC](https://community.zeek.org/t/redef-logelasticsearch-variables/2569/7 "2013-02-27T17:03:51Z")
Classification: UNCLASSIFIED Caveats: NONE If I understand correctly, the input framework is the way that log files, for instance from a host, can be ingested by Bro? One of the things I was interested in doing was identifying key information from a log, such as a MS Windows Event log, via event viewer to syslog, with network traffic. This would be similar to how Bro can analyze SSL Certs. What I was wondering about was what could Bro do with a filesystem beyond log files? An example on a MS system would be identifying the last run time of a file via prefetch data that was communicating over a socket, that was identified by Bro. Of course this is assuming that Bro has access to the filesystem of the system in question. Regards, SSG Charles "Chuck" A. Fair Information Systems/Information Assurance NCO Information Technology Training Center, PEC, Camp Robinson AR ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 27, 2013, 5:11pm UTC](https://community.zeek.org/t/redef-logelasticsearch-variables/2569/8 "2013-02-27T17:11:43Z")
> If I understand correctly, the input framework is the way that log files, > for instance from a host, can be ingested by Bro? It's a bit more comprehensive than that since the input framework is plugin based and we will be releasing plugins for more things over time (databases, etc). > One of the things I was > interested in doing was identifying key information from a log, such as a MS > Windows Event log, via event viewer to syslog, with network traffic. I don't want to talk about it publicly yet because things are still a little unclear, but I've been having concrete discussions with a couple of people related to this functionality. It's definitely on our radar.   .Seth ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/redef-logelasticsearch-variables/2569/9 "2022-05-06T15:40:48Z")