policy/tuning/logs-to-elasticsearch.bro

LogElasticSearch

Load this script to enable global log output to an ElasticSearch database.

Namespace:LogElasticSearch
Source File:/scripts/policy/tuning/logs-to-elasticsearch.bro

Summary

Options

LogElasticSearch::excluded_log_ids: set &redef Optionally ignore any Log::ID from being sent to ElasticSearch with this script.
LogElasticSearch::rotation_interval: interval &redef An elasticsearch specific rotation interval.
LogElasticSearch::send_logs: set &redef If you want to explicitly only send certain Log::ID streams, add them to this set.

Detailed Interface

Options

LogElasticSearch::excluded_log_ids
Type:set [Log::ID]
Attributes:&redef
Default:{}

Optionally ignore any Log::ID from being sent to ElasticSearch with this script.

LogElasticSearch::rotation_interval
Type:interval
Attributes:&redef
Default:3.0 hrs

An elasticsearch specific rotation interval.

LogElasticSearch::send_logs
Type:set [Log::ID]
Attributes:&redef
Default:{}

If you want to explicitly only send certain Log::ID streams, add them to this set. If the set remains empty, all will be sent. The LogElasticSearch::excluded_log_ids option will remain in effect as well.


Copyright 2013, The Bro Project. Last updated on June 15, 2015. Created using Sphinx 1.2.2.