policy/tuning/logs-to-elasticsearch.bro
-
LogElasticSearch
Load this script to enable global log output to an ElasticSearch database.
Detailed Interface
Options
-
LogElasticSearch::excluded_log_ids
-
Optionally ignore any Log::ID from being sent to
ElasticSearch with this script.
-
LogElasticSearch::rotation_interval
-
An elasticsearch specific rotation interval.
-
LogElasticSearch::send_logs
-
If you want to explicitly only send certain Log::ID
streams, add them to this set. If the set remains empty, all will
be sent. The LogElasticSearch::excluded_log_ids option
will remain in effect as well.