I recently used zeek IDS on FreeBSD 12.1 - Default Policy (GetTraffic
from TAP on the network) and i want to send all the logs to ELK in
I saw Filebeat ports on BSD is old and has problems.
How can i send the logs from the BSD to the Elastic (what is the
You should be able to fire up Elastic, Logstash and Kibana on FreeBSD, using recommend Logstash configs to read in the log files from the file system. I can check about the Filebeat port to see if that can be updated or fixed.
I myself just use the CLI tools but have been working on something “Not Java” to ingest log files into other than Splunk.
I read OP question as "I have Zeek running on FreeBSD, what is a
sensible option for shipping logs from the sensor to an Elastic
Stack?" Apologies if it's the wrong read.
In that case I wouldn't want to install either the whole stack nor
even Logstash on the sensor as it alone tends to consume an excessive
amount of memory, not what you want on a sensor. Filebeat (a small
footprint data collector/shipper) is the way to go if you're shipping
If Filebeat isn't an option on the platform, maybe explore Fluent Bit:
Fluent Bit can output directly to Elasticsearch:
Even a Fluentd can run with typically lower memory consumption than
Logstash, so perhaps worth exploring both/either:
Fluentd can also output to Elasticsearch:
There are other options for shippers too, such as Syslog-ng:
You can try rsyslog imfile module to send logs to logstash. The following is my configuration.
sec-x sec-x <firstname.lastname@example.org> 于2020年1月5日周日 下午11:36写道：