# Zeek with ELK **URL:** \ **Category:** Zeek\ **Created:** [January 5, 2020, 3:32pm UTC](https://community.zeek.org/t/zeek-with-elk/5959 "2020-01-05T15:32:48Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sec-x\_sec-x](https://avatars.discourse-cdn.com/v4/letter/s/4af34b/32.png) [@sec-x\_sec-x](https://community.zeek.org/u/sec-x_sec-x)\ **Post date:** [January 5, 2020, 3:32pm UTC](https://community.zeek.org/t/zeek-with-elk/5959/1 "2020-01-05T15:32:48Z")
Hi, I recently used zeek IDS on FreeBSD 12.1 - Default Policy (GetTraffic from TAP on the network) and i want to send all the logs to ELK in realtime. I saw Filebeat ports on BSD is old and has problems. How can i send the logs from the BSD to the Elastic (what is the correct/best way)? Thanks, CM. ---
**Author:** ![Patrick\_Kelley](https://avatars.discourse-cdn.com/v4/letter/p/a87d85/32.png) [@Patrick\_Kelley](https://community.zeek.org/u/Patrick_Kelley)\ **Post date:** [January 5, 2020, 4:00pm UTC](https://community.zeek.org/t/zeek-with-elk/5959/2 "2020-01-05T16:00:16Z")
Logstash is the best option. [http://thegreyblog.blogspot.com/2014/01/installing-logstash-on-freebsd.html?m=1](http://thegreyblog.blogspot.com/2014/01/installing-logstash-on-freebsd.html?m=1) **Patrick Kelley, CISSP, C|EH, ITIL** _CTO_ [patrick.kelley@criticalpathsecurity.com](mailto:patrick.kelley@criticalpathsecurity.com) ![](https://docs.google.com/uc?export=download&id=14A5_m49pLX4F6JEPVhLf902vExNmV5OA&revid=0B7inYJ_Q8hDQbnNTRzhtaUNCMHlVeld5RXREWWFjTjU4MHVzPQ) ---
**Author:** ![Michael\_Shirk](https://avatars.discourse-cdn.com/v4/letter/m/aeb1de/32.png) [@Michael\_Shirk](https://community.zeek.org/u/Michael_Shirk)\ **Post date:** [January 5, 2020, 4:05pm UTC](https://community.zeek.org/t/zeek-with-elk/5959/3 "2020-01-05T16:05:52Z")
You should be able to fire up Elastic, Logstash and Kibana on FreeBSD, using recommend Logstash configs to read in the log files from the file system. I can check about the Filebeat port to see if that can be updated or fixed. I myself just use the CLI tools but have been working on something “Not Java” to ingest log files into other than Splunk. ---
**Author:** ![Darren\_S](https://avatars.discourse-cdn.com/v4/letter/d/59ef9b/32.png) [@Darren\_S](https://community.zeek.org/u/Darren_S)\ **Post date:** [January 6, 2020, 12:40am UTC](https://community.zeek.org/t/zeek-with-elk/5959/4 "2020-01-06T00:40:02Z")
I read OP question as "I have Zeek running on FreeBSD, what is a sensible option for shipping logs from the sensor to an Elastic Stack?" Apologies if it's the wrong read. In that case I wouldn't want to install either the whole stack nor even Logstash on the sensor as it alone tends to consume an excessive amount of memory, not what you want on a sensor. Filebeat (a small footprint data collector/shipper) is the way to go if you're shipping remotely. If Filebeat isn't an option on the platform, maybe explore Fluent Bit: [https://github.com/fluent/fluent-bit](https://github.com/fluent/fluent-bit) [https://fluentbit.io/](https://fluentbit.io/) Fluent Bit can output directly to Elasticsearch: [https://fluentbit.io/documentation/0.14/output/elasticsearch.html](https://fluentbit.io/documentation/0.14/output/elasticsearch.html) Even a Fluentd can run with typically lower memory consumption than Logstash, so perhaps worth exploring both/either: [https://github.com/fluent/fluentd](https://github.com/fluent/fluentd) [https://www.fluentd.org/](https://www.fluentd.org/) Fluentd can also output to Elasticsearch: [https://docs.fluentd.org/output/elasticsearch](https://docs.fluentd.org/output/elasticsearch) There are other options for shippers too, such as Syslog-ng: [https://www.syslog-ng.com/community/b/blog/posts/logging-to-elasticsearch-made-simple-with-syslog-ng](https://www.syslog-ng.com/community/b/blog/posts/logging-to-elasticsearch-made-simple-with-syslog-ng) - Darren ---
**Author:** ![duhang](https://avatars.discourse-cdn.com/v4/letter/d/bbce88/32.png) [@duhang](https://community.zeek.org/u/duhang)\ **Post date:** [January 6, 2020, 1:52am UTC](https://community.zeek.org/t/zeek-with-elk/5959/5 "2020-01-06T01:52:52Z")
You can try rsyslog imfile module to send logs to logstash. The following is my configuration. $ModLoad imfile $InputFileName /usr/local/bro/logs/current/dns.log $InputFileTag dns: $InputFileStateFile stat-dns $InputFileSeverity info $InputFileFacility local2 $InputRunFileMonitor $SystemLogRateLimitInterval 0 $SystemLogRateLimitBurst 0 $MaxMessageSize 64k sec-x sec-x \<[center.mnt@gmail.com](mailto:center.mnt@gmail.com)\> 于2020年1月5日周日 下午11:36写道： ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/zeek-with-elk/5959/6 "2022-05-06T15:46:59Z")