Zeek with ELK


I recently used zeek IDS on FreeBSD 12.1 - Default Policy (GetTraffic
from TAP on the network) and i want to send all the logs to ELK in

I saw Filebeat ports on BSD is old and has problems.

How can i send the logs from the BSD to the Elastic (what is the
correct/best way)?



Logstash is the best option.


Patrick Kelley, CISSP, C|EH, ITIL

You should be able to fire up Elastic, Logstash and Kibana on FreeBSD, using recommend Logstash configs to read in the log files from the file system. I can check about the Filebeat port to see if that can be updated or fixed.

I myself just use the CLI tools but have been working on something “Not Java” to ingest log files into other than Splunk.

I read OP question as "I have Zeek running on FreeBSD, what is a
sensible option for shipping logs from the sensor to an Elastic
Stack?" Apologies if it's the wrong read.

In that case I wouldn't want to install either the whole stack nor
even Logstash on the sensor as it alone tends to consume an excessive
amount of memory, not what you want on a sensor. Filebeat (a small
footprint data collector/shipper) is the way to go if you're shipping

If Filebeat isn't an option on the platform, maybe explore Fluent Bit:


Fluent Bit can output directly to Elasticsearch:

Even a Fluentd can run with typically lower memory consumption than
Logstash, so perhaps worth exploring both/either:


Fluentd can also output to Elasticsearch:

There are other options for shippers too, such as Syslog-ng:

- Darren

You can try rsyslog imfile module to send logs to logstash. The following is my configuration.

$ModLoad imfile
$InputFileName /usr/local/bro/logs/current/dns.log
$InputFileTag dns:
$InputFileStateFile stat-dns
$InputFileSeverity info
$InputFileFacility local2

$SystemLogRateLimitInterval 0
$SystemLogRateLimitBurst 0
$MaxMessageSize 64k

sec-x sec-x <center.mnt@gmail.com> 于2020年1月5日周日 下午11:36写道: